summaryrefslogtreecommitdiff
path: root/docs/configuration/firewall
AgeCommit message (Collapse)Author
2026-06-11docs: fix stale .png/.jpg image refs to match .webp assets in Sagitta (#2098)LiudmylaNad
Signed-off-by: MilaNad <l.nadolina@vyos.io>
2026-05-10chore: remove RST swap mechanism, archive rst-*.rst under docs/_rst_legacy/Yuriy Andamasov
The swap mechanism (RST-as-fallback for migrated MD pages) is dormant — docs/_rst_overrides.txt has been empty since the MyST flip trio landed. The mechanism's surface area is dead weight and the rst-*.rst shadows scattered across the source tree cause Context7's parser to misclassify the project as RST. Sibling PRs: - yuriy/remove-rst-swap-mechanism (rolling) - yuriy/remove-rst-swap-mechanism-circinus Changes: - Move 210 rst-*.rst shadow files into docs/_rst_legacy/ preserving subdirectory structure. They remain in the repo for reference; Sphinx excludes the folder via exclude_patterns. - Strip swap_sources.py invocation from docs/Makefile. - Strip rst-*.rst exclude entry and the _md_exclude.txt loader from docs/conf.py; replace with a single _rst_legacy exclude. - Delete scripts/swap_sources.py, tests/test_swap_sources.py, docs/_rst_overrides.txt. - Update AGENTS.md: drop the "RST override mechanism" section and the test-runner snippet for the deleted test. Note: .readthedocs.yml on sagitta has no jobs: block to remove (the swap was wired only at build-time via the Makefile chain on this branch). Verified: sphinx-build -b html with --keep-going produces identical warning set (409 unique — pre-existing cli.rst/aws.rst title-level warnings on this branch), identical sitemap entry count (215), identical llms.txt entry count (23), zero rst-* URLs in any artifact. 🤖 Generated by [robots](https://vyos.io)
2026-05-06feat: flip swap mechanism on sagitta — MD as primary, RST as overrideYuriy Andamasov
Mirror of #1899 (current) and #1900 (circinus) for sagitta. Same logic, same scripts, per-branch file set. Changes: - Rename docs/**/md-<stem>.md to docs/**/<stem>.md (drop md- prefix) for all 210 stems previously listed in docs/_swap.txt - Rename docs/**/<stem>.rst to docs/**/rst-<stem>.rst (add rst- prefix) for the same 210 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty - conf.py exclude_patterns flipped: rst-*.rst excluded by default - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt - scripts/swap_sources.py imported from current (post-#1899 rewrite, with inverted rename direction) - scripts/import_myst.py and tests/test_import_myst.py deleted (obsolete) - tests/test_swap_sources.py imported from current (post-#1899 rewrite) Side-effect: fixes the same 404 on /en/1.4/ View page source links that #1899 fixed for /en/rolling/ and #1900 fixed for /en/1.5/. Per-branch differences vs #1899: - sagitta has 210 stems vs current's 254 (sagitta has no vpp pages and fewer current-only features; cli + installation/cloud/aws are still RST-only on sagitta pending the title-level fix follow-up) - otherwise the script/conf.py/test changes are byte-identical with current Generated by robots https://vyos.io
2026-05-06feat: import MyST swap mechanism + content for sagitta (replaces #1886)Yuriy Andamasov
Replaces the broken #1886 with a fresh, properly-converted MyST set for the sagitta (1.4.x) docs, mirroring what landed for circinus via #1897. This PR: - Re-imports 210 md-*.md files for sagitta. Source: ran the pipelines rst-to-myst converter (chrisjsewell/rst-to-myst v0.4.0, with pandoc fallback) on sagittas RST. Post-processed via the pipelines postprocess stage (10 ordered fixes for blanks, admonitions, label hyphens, pandoc artifacts, structural blanks, linter markers). Compared to the broken #1886 content (which was left over from an earlier stage-1-only run): zero raw `<div class=>` remnants. - For 23 stems where sagittas RST is byte-identical with currents RST (mostly stable policy/protocol pages and the 404 page), reuses currents already-validated md-*.md content rather than re-converting. - Drops cli and installation/cloud/aws from sagittas swap set: their RST has SEVERE/4 "Title level inconsistent" errors that crash rst-to-myst; they need an independent RST-source fix and are kept as RST-only for now. - Adds the per-page swap mechanism: scripts/swap_sources.py, scripts/import_myst.py, the matching tests under tests/, _swap.txt with 210 stems, _ext/vyos.py MyST renderer fallback, Makefile swap-wrapped targets, .readthedocs.yml swap pre/post hooks. - Adds 187 .webp images and removes 235 superseded .jpg/.png/.jpeg static assets; flips html_logo to vyos-logo.webp. - Adds the MyST swap-related blocks to docs/conf.py only: myst_enable_extensions, myst_fence_as_directive, md-*.md exclude patterns, _swap_exclude.txt reader, _prefer_webp and _copy_md_sources setup hooks. github_version fallback set to 'sagitta' to match the branch (parallel to currents 'current' and circinuss 'circinus'). Deliberately excluded (per user direction): - llms.txt and sphinx-llms-txt / sphinx-sitemap config: these will land separately for sagitta via #1870 plus a new sagitta-specific llms.txt template PR. The conf.py here does not pull those extensions in, so the build does not depend on the new pip packages. Verification before pushing: - 210 md-*.md = 210 _swap.txt stems = 210 RST siblings on sagitta (1:1:1). - 0 files contain raw `<div class=` (the breakage that took down /en/1.5/). - conf.py copyright/version/release preserve sagittas values (2024 / 1.4 / "1.4.x (sagitta)") - not currents. - html_title from currents conf.py removed - PR #1880 is the right place for sagittas branch-localized title. Supersedes / closes on merge: - #1886 (broken converter output, would break /en/1.4/ if merged). Generated by robots https://vyos.io
2026-05-06Revert "Add incremental RST-to-MyST swap mechanism (sagitta) (#1868)" (#1894)Daniil Baturin
This reverts commit 22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e.
2026-05-06Add incremental RST-to-MyST swap mechanism (sagitta) (#1868)Yuriy Andamasov
* feat(swap-sagitta): add incremental RST-to-MyST swap mechanism Backport of the swap mechanism from feat/incremental-myst-swap onto the sagitta release branch. Built directly on top of origin/sagitta, so the underlying RST tree is sagitta's (not current's). Mechanism: - scripts/import_myst.py — import md from myst/* with md- prefix - scripts/swap_sources.py — rename md-{name}.md → {name}.md before Sphinx builds, restore after; writes _build/_swap_state.json and _build/_swap_exclude.txt - docs/Makefile — html/dirhtml/pdf/livehtml all run swap → build → trap restore; explicit `swap` and `restore` targets too - docs/conf.py — MyST extensions enabled; swap exclude_patterns loader; _prefer_webp builder hook so html prefers webp over png Content: - 202 md-prefixed pages from origin/myst/sagitta (md-{name}.md alongside each {name}.rst counterpart) - 1 plain MyST-only page from myst/sagitta where no .rst exists (already at canonical name on sagitta: docs/copyright.md) - 240 .webp images from myst/sagitta (added alongside the existing PNG/JPG so RST builds keep their assets) - docs/_swap.txt populated with all 202 stems → MyST is served by default, revert a page by removing its stem from _swap.txt 🤖 Generated by [robots](https://vyos.io) * feat(conf): copy .md sources into HTML output for plain-text serving Adds a build-finished hook that mirrors every .md file from the Sphinx source tree into the HTML output directory verbatim, making unrendered MyST sources accessible alongside HTML renders at the same URL path. 🤖 Generated by [robots](https://vyos.io) * docs: address review feedback (backport from PR #1857) Fix conversion artifacts, typos, and technical inaccuracies applicable to the sagitta branch: curly quotes, typos (deamonless, cammans, amdifferent, trough), incorrect firewall command paths, missing closing brace in zone-policy, peer name inconsistencies, hardcoded passwords replaced with vault references, and md-*.md exclusion in conf.py. 🤖 Generated by [robots](https://vyos.io) * docs: port .readthedocs.yml jobs, _ext/vyos.py fallback and swap-script tests from PR #1857 Parity backport from PR #1857 (current) — three pieces were missing on sagitta. - .readthedocs.yml: add build.jobs.pre_build / post_build hooks that run scripts/swap_sources.py --swap before the Sphinx build and --restore after. Without this, the swap mechanism ships but never runs on RTD builds for this branch — the swap is a silent no-op. - docs/_ext/vyos.py: CmdInclude.run() now falls back to nested_parse() when self.state._renderer is not present. Required for cfgcmd / opcmd / cmdincludemd directives to render correctly when included from MyST pages (the swap mechanism's whole point). Sagitta-only delta on _ext/vyos.py (the path = str(path) line on 224) is intentionally untouched. - tests/test_import_myst.py, tests/test_swap_sources.py: tests for the swap scripts. The scripts on this branch are byte-identical to current's, so the same tests apply. Travels with the branch so CI catches per-branch regressions if the scripts ever drift. 🤖 Generated by [robots](https://vyos.io) * fix(conf): skip md-*.md staging files in _copy_md_sources Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/919695a7-688d-41b9-89f0-540684625dbc Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>
2024-06-20Update flowtables.rstSimon Novak
chore(docs): fixed typos & relevant distinctions for ipv4, ipv6 (cherry picked from commit e2427a9c2515780a12fc3a6702cfc95793053605)
2024-06-18Configuration Blueprints: add new example for firewall+vrf. Also, add note ↵Nicolas Fort
about usage of inbound and outbound interface when interface is attached to a non-default vrf. (cherry picked from commit fe416b56cfa30494172a0310c16fd2787330c7bb) # Conflicts: # docs/configexamples/zone-policy.rst
2024-05-15Fix lint issuesNicolas Vollmar
(cherry picked from commit c432da682bf117184729c36e84850d384ea34f49)
2024-05-10Merge pull request #1435 from vyos/mergify/bp/sagitta/pr-1434Christian Breunig
Firewall: add documentation for dynamic firewall groups. (backport #1434)
2024-05-10firewall: T5729: remove obsolete enable and correct interface nameNicolas Vollmar
(cherry picked from commit a2c982709a765a007926e7af3c0d4e55310ab3b9)
2024-05-10Firewall: add documentation for dynamic firewall groups.Nicolas Fort
(cherry picked from commit 245e133042b160ca9f28b4be13d2b5c8e0edba70)
2024-05-08State correct rule on first replyNicolas Vollmar
(cherry picked from commit 166d87e92df0b5bd6a8c57023a914086e296fd3f)
2024-05-06Modified old option from 'enable-default-log' to new one 'default-log'srividya0208
(cherry picked from commit 0e98fdb64154011850ba5705b9c6f8e74868c955)
2024-04-07Firewall: Fix typo "addtion" -> "addition"Davide Beatrici
(cherry picked from commit a55f214ab44253a444a958be4975e143ab5d83d4)
2024-03-25T5614: extend ipv4 firewall documentation on conntrack-helper matchingGinko (Giggum)
2024-03-05backport all firewall based documentationrebortg
2023-12-28dhcp-server: update docs for op-mode command <show dhcp server leases>Nicolas Fort
(cherry picked from commit 0893ca769b1796d2d61dc26a0c0c13d1eda56f5e)
2023-12-27firewall: sync to master branchChristian Breunig
2023-11-29docs: fix to code snippet in Quick Start/Firewall and typo Firewall/Global ↵Giggum
Options sagitta/quick-start.html: Fix to replace "interface-name" with "name" for rule 30 and 40 in code snippet to correct syntax error. sagitta/configuration/firewall/global-options.html: Fix to improve correctness is use of English language from "conform" to "confirming" On branch sagitta_giggum Changes to be committed: modified: quick-start.rst modified: configuration/firewall/global-options.rst
2023-11-23backport Firewall docs from masterrebortg
2023-09-08Firewall refactor: add visible note in firewall docs: zone, quick-start and ↵Nicolas Fort
config blueprint zone-policy
2023-09-04correction of ipsec compression syntax and added a referencesrividya0208
for changes done for zone based firewall
2023-08-25firewall: correction of default-action for rule-setsrividya0208
2023-08-14Update release version on indexNicolás Fort
2023-06-27T5160: New firewall cli - Update documentation for new firewall structure. ↵Nicolas Fort
Also, keep old/legacy firewall documentation.
2023-03-17T5050: firewall: add log-options in firewall docsNicolas Fort
2023-03-13Update missing matcher options in firewall and policy route: packet-length ↵Nicolas Fort
in policy route, queue action and queue options in firewall, and packet-type on both firewall and policy route
2023-01-03zonefirewall: fix wrong characterrebortg
2022-12-23T4886: Add connection-mark information to firewall and policy docs.Nicolas Fort
2022-11-29Fwall doc: update actions and matching criterias (#900)Nicolás Fort
* Update firewall docs: jump action added, dscp and interface matchers, source/destination fqdn * Firewall: add dhcp and interface matchers. Add jump actions and fix special characters notation
2022-11-27Merge pull request #895 from nicolas-fort/fwall_updateRobert Göhler
Firewall update: add groups and note to firewall interface section
2022-11-24Firewall update: add groups and note to firewall interface sectionNicolas Fort
2022-11-03firewall: T4612: Support arbitrary netmasks DocumentationRain
2022-10-08firewall: reduce line ending in rule-setGanawa Juanah
2022-10-08firewall: reduce line ending in rule-setGanawa Juanah
2022-10-08firewall: correct typoGanawa Juanah
2022-10-08firewall: correct firewall exampleGanawa Juanah
2022-10-08firewall: correct rule-set interface assignmentGanawa Juanah
2022-09-14firewall: T2199: adjust to new 1.4 CLI syntaxChristian Poessinger
"set zone-policy zone <name>" moved to "set firewall zone <name>".
2022-09-06Firewall. Update matching criteria for firewall rulesNicolas Fort
2022-07-09Firewall: add 'recent' matching criteriaRemi
2022-07-06Firewall: T4299: Add inverse-match to geoipRemi van Dijk | Link-it
2022-06-28Firewall: T4299: add geoip matching criteriaNicolas Fort
2022-06-14Firewall: Add firewall documentationNicolas Fort
2022-05-12Add firewall connection-status nat documentationNicolas Fort
2022-04-24deletion of note related to natsrividya0208
Removed the note from the firewall page as nat grouping is not added yet Added the information about new option 'none' in the site-to-site ipsec vpn page
2022-01-12firewall: T4100: default action numbergoodNETnick
2021-10-11Merge pull request #630 from showipintbri/patch-6Robert Göhler
Update index.rst
2021-10-08interfaces: T3090: add new TCP MSS clamping CLI commandsChristian Poessinger