summaryrefslogtreecommitdiff
path: root/docs/configuration/vpn
AgeCommit message (Collapse)Author
7 daysdocs: fix MyST roles used inside eval-rst blocks (#2125)sagittaLiudmylaNad
* docs: fix MyST roles used inside eval-rst blocks * Apply suggestions from code review Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> --------- Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
2026-06-11docs: fix stale .png/.jpg image refs to match .webp assets in Sagitta (#2098)LiudmylaNad
Signed-off-by: MilaNad <l.nadolina@vyos.io>
2026-05-14docs: rewrap long prose lines in sstp to fit 80-char limitYuriy Andamasov
2026-05-14docs: drop unused {include} /_include/common-references.txt from sstpYuriy Andamasov
2026-05-10chore: remove RST swap mechanism, archive rst-*.rst under docs/_rst_legacy/Yuriy Andamasov
The swap mechanism (RST-as-fallback for migrated MD pages) is dormant — docs/_rst_overrides.txt has been empty since the MyST flip trio landed. The mechanism's surface area is dead weight and the rst-*.rst shadows scattered across the source tree cause Context7's parser to misclassify the project as RST. Sibling PRs: - yuriy/remove-rst-swap-mechanism (rolling) - yuriy/remove-rst-swap-mechanism-circinus Changes: - Move 210 rst-*.rst shadow files into docs/_rst_legacy/ preserving subdirectory structure. They remain in the repo for reference; Sphinx excludes the folder via exclude_patterns. - Strip swap_sources.py invocation from docs/Makefile. - Strip rst-*.rst exclude entry and the _md_exclude.txt loader from docs/conf.py; replace with a single _rst_legacy exclude. - Delete scripts/swap_sources.py, tests/test_swap_sources.py, docs/_rst_overrides.txt. - Update AGENTS.md: drop the "RST override mechanism" section and the test-runner snippet for the deleted test. Note: .readthedocs.yml on sagitta has no jobs: block to remove (the swap was wired only at build-time via the Makefile chain on this branch). Verified: sphinx-build -b html with --keep-going produces identical warning set (409 unique — pre-existing cli.rst/aws.rst title-level warnings on this branch), identical sitemap entry count (215), identical llms.txt entry count (23), zero rst-* URLs in any artifact. 🤖 Generated by [robots](https://vyos.io)
2026-05-06feat: flip swap mechanism on sagitta — MD as primary, RST as overrideYuriy Andamasov
Mirror of #1899 (current) and #1900 (circinus) for sagitta. Same logic, same scripts, per-branch file set. Changes: - Rename docs/**/md-<stem>.md to docs/**/<stem>.md (drop md- prefix) for all 210 stems previously listed in docs/_swap.txt - Rename docs/**/<stem>.rst to docs/**/rst-<stem>.rst (add rst- prefix) for the same 210 stems - Repurpose docs/_swap.txt as docs/_rst_overrides.txt; initially empty - conf.py exclude_patterns flipped: rst-*.rst excluded by default - conf.py runtime-artifact references updated to _rst_override_state.json and _md_exclude.txt - scripts/swap_sources.py imported from current (post-#1899 rewrite, with inverted rename direction) - scripts/import_myst.py and tests/test_import_myst.py deleted (obsolete) - tests/test_swap_sources.py imported from current (post-#1899 rewrite) Side-effect: fixes the same 404 on /en/1.4/ View page source links that #1899 fixed for /en/rolling/ and #1900 fixed for /en/1.5/. Per-branch differences vs #1899: - sagitta has 210 stems vs current's 254 (sagitta has no vpp pages and fewer current-only features; cli + installation/cloud/aws are still RST-only on sagitta pending the title-level fix follow-up) - otherwise the script/conf.py/test changes are byte-identical with current Generated by robots https://vyos.io
2026-05-06feat: import MyST swap mechanism + content for sagitta (replaces #1886)Yuriy Andamasov
Replaces the broken #1886 with a fresh, properly-converted MyST set for the sagitta (1.4.x) docs, mirroring what landed for circinus via #1897. This PR: - Re-imports 210 md-*.md files for sagitta. Source: ran the pipelines rst-to-myst converter (chrisjsewell/rst-to-myst v0.4.0, with pandoc fallback) on sagittas RST. Post-processed via the pipelines postprocess stage (10 ordered fixes for blanks, admonitions, label hyphens, pandoc artifacts, structural blanks, linter markers). Compared to the broken #1886 content (which was left over from an earlier stage-1-only run): zero raw `<div class=>` remnants. - For 23 stems where sagittas RST is byte-identical with currents RST (mostly stable policy/protocol pages and the 404 page), reuses currents already-validated md-*.md content rather than re-converting. - Drops cli and installation/cloud/aws from sagittas swap set: their RST has SEVERE/4 "Title level inconsistent" errors that crash rst-to-myst; they need an independent RST-source fix and are kept as RST-only for now. - Adds the per-page swap mechanism: scripts/swap_sources.py, scripts/import_myst.py, the matching tests under tests/, _swap.txt with 210 stems, _ext/vyos.py MyST renderer fallback, Makefile swap-wrapped targets, .readthedocs.yml swap pre/post hooks. - Adds 187 .webp images and removes 235 superseded .jpg/.png/.jpeg static assets; flips html_logo to vyos-logo.webp. - Adds the MyST swap-related blocks to docs/conf.py only: myst_enable_extensions, myst_fence_as_directive, md-*.md exclude patterns, _swap_exclude.txt reader, _prefer_webp and _copy_md_sources setup hooks. github_version fallback set to 'sagitta' to match the branch (parallel to currents 'current' and circinuss 'circinus'). Deliberately excluded (per user direction): - llms.txt and sphinx-llms-txt / sphinx-sitemap config: these will land separately for sagitta via #1870 plus a new sagitta-specific llms.txt template PR. The conf.py here does not pull those extensions in, so the build does not depend on the new pip packages. Verification before pushing: - 210 md-*.md = 210 _swap.txt stems = 210 RST siblings on sagitta (1:1:1). - 0 files contain raw `<div class=` (the breakage that took down /en/1.5/). - conf.py copyright/version/release preserve sagittas values (2024 / 1.4 / "1.4.x (sagitta)") - not currents. - html_title from currents conf.py removed - PR #1880 is the right place for sagittas branch-localized title. Supersedes / closes on merge: - #1886 (broken converter output, would break /en/1.4/ if merged). Generated by robots https://vyos.io
2026-05-06Revert "Add incremental RST-to-MyST swap mechanism (sagitta) (#1868)" (#1894)Daniil Baturin
This reverts commit 22e34ce5aee24d2fd11f8205522ab7ecdb3c4c5e.
2026-05-06Add incremental RST-to-MyST swap mechanism (sagitta) (#1868)Yuriy Andamasov
* feat(swap-sagitta): add incremental RST-to-MyST swap mechanism Backport of the swap mechanism from feat/incremental-myst-swap onto the sagitta release branch. Built directly on top of origin/sagitta, so the underlying RST tree is sagitta's (not current's). Mechanism: - scripts/import_myst.py — import md from myst/* with md- prefix - scripts/swap_sources.py — rename md-{name}.md → {name}.md before Sphinx builds, restore after; writes _build/_swap_state.json and _build/_swap_exclude.txt - docs/Makefile — html/dirhtml/pdf/livehtml all run swap → build → trap restore; explicit `swap` and `restore` targets too - docs/conf.py — MyST extensions enabled; swap exclude_patterns loader; _prefer_webp builder hook so html prefers webp over png Content: - 202 md-prefixed pages from origin/myst/sagitta (md-{name}.md alongside each {name}.rst counterpart) - 1 plain MyST-only page from myst/sagitta where no .rst exists (already at canonical name on sagitta: docs/copyright.md) - 240 .webp images from myst/sagitta (added alongside the existing PNG/JPG so RST builds keep their assets) - docs/_swap.txt populated with all 202 stems → MyST is served by default, revert a page by removing its stem from _swap.txt 🤖 Generated by [robots](https://vyos.io) * feat(conf): copy .md sources into HTML output for plain-text serving Adds a build-finished hook that mirrors every .md file from the Sphinx source tree into the HTML output directory verbatim, making unrendered MyST sources accessible alongside HTML renders at the same URL path. 🤖 Generated by [robots](https://vyos.io) * docs: address review feedback (backport from PR #1857) Fix conversion artifacts, typos, and technical inaccuracies applicable to the sagitta branch: curly quotes, typos (deamonless, cammans, amdifferent, trough), incorrect firewall command paths, missing closing brace in zone-policy, peer name inconsistencies, hardcoded passwords replaced with vault references, and md-*.md exclusion in conf.py. 🤖 Generated by [robots](https://vyos.io) * docs: port .readthedocs.yml jobs, _ext/vyos.py fallback and swap-script tests from PR #1857 Parity backport from PR #1857 (current) — three pieces were missing on sagitta. - .readthedocs.yml: add build.jobs.pre_build / post_build hooks that run scripts/swap_sources.py --swap before the Sphinx build and --restore after. Without this, the swap mechanism ships but never runs on RTD builds for this branch — the swap is a silent no-op. - docs/_ext/vyos.py: CmdInclude.run() now falls back to nested_parse() when self.state._renderer is not present. Required for cfgcmd / opcmd / cmdincludemd directives to render correctly when included from MyST pages (the swap mechanism's whole point). Sagitta-only delta on _ext/vyos.py (the path = str(path) line on 224) is intentionally untouched. - tests/test_import_myst.py, tests/test_swap_sources.py: tests for the swap scripts. The scripts on this branch are byte-identical to current's, so the same tests apply. Travels with the branch so CI catches per-branch regressions if the scripts ever drift. 🤖 Generated by [robots](https://vyos.io) * fix(conf): skip md-*.md staging files in _copy_md_sources Agent-Logs-Url: https://github.com/vyos/vyos-documentation/sessions/919695a7-688d-41b9-89f0-540684625dbc Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: andamasov <12631358+andamasov@users.noreply.github.com>
2025-11-26ipsec: T8027: voluntarily send its certificate, even if it wasn't requested ↵mergify[bot]
(#1712) (#1715) (cherry picked from commit 8c0c0bfe1c041fb6cd48402db033351f094c0e0c) # Conflicts: # docs/configuration/vpn/ipsec/remoteaccess_ipsec.rst Co-authored-by: Christian Breunig <christian@breunig.cc>
2025-07-28Updated site-to-site IPsec VPN documentation (#1660)aapostoliuk
* Updated site-to-site IPsec VPN documentation Added general theoretical IPsec documentation. Changed site-to-site IPsec VPN documentation. Added steps for configuration. Added documentation for troubleshooting site-to-site IPsec VPN. Backported from https://github.com/vyos/vyos-documentation/pull/1653 --------- Co-authored-by: aapostoliuk <aapostoliuk@vyos.io> Co-authored-by: Daniil Baturin <daniil@baturin.org>
2025-07-21Updated the installation page with latest information (#1659)srividya0208
2024-08-10Update l2tp.rstBalazs Szenczy
Small correction (cherry picked from commit e835834cded213855cde83335fc49b0d19b9004c)
2024-07-22ipsec: T6599: add CLI documentation to disable ESP re-keyChristian Breunig
(cherry picked from commit 284b5b8e9bec10f4e69c0add321361a832d39b66)
2024-07-18VPN documentation proofreading (#1506)whyrlpool
* Fix typos in openconnect.rst change Cerbort->Certbot Update first line to reflect that openconnect was introduced in 1.3-rolling (T2036) * typo in dmvpn.rst * ipsec.rst justification, minor phrasing changes * l2tp.rst justification and phrasing changes. * sstp.rst phrasing, justification changes * Update ipsec.rst rephrase for clarity and to avoid possessive plural apostrophe (cherry picked from commit 873a461bdf972ebd815baf50893700b0a2518213)
2024-07-13ipsec: Added information about operational commandssrividya0208
(cherry picked from commit cd1dcb5d8e66e3431415ebf31a2d5902b30c1ffc)
2024-05-10sstp: T4393: Add support to configure host-name (SNI)Nataliia Solomko
(cherry picked from commit 30af00bd7f3b97e5aed539f42fbfc6eaa5535158)
2024-05-05Fixed examples in accel-ppp services in IPv6 sectionaapostoliuk
Fixed examples in accel-ppp services in IPv6 section (cherry picked from commit 899acac204ba39b6d092ebc389e435a669d39258)
2024-04-16fix several build warnings and errorsrebortg
2024-03-05Merge pull request #1309 from vyos/mergify/bp/sagitta/pr-1300Robert Göhler
Rewritten the SSTP server documentation (backport #1300)
2024-03-05Update sstp.rstRobert Göhler
2024-03-05Rewritten the PPTP server documentationaapostoliuk
Fully rewritten PPTP server documentation. (cherry picked from commit 8cb0070b51edf550189a9ccf5f1a92bf537c3572)
2024-03-05Rewritten the SSTP server documentationaapostoliuk
Fully rewritten SSTP server documentation. (cherry picked from commit d71c4607fa0c330a3c6269811b2126a25ceb91f7) # Conflicts: # docs/configuration/vpn/sstp.rst
2024-02-27ipsec: add IKEv2 road-warrior documentationChristian Breunig
(cherry picked from commit deb4e15e51e2b5f5b281f0e17961a5c10d036bfe)
2024-02-26Rewritten the L2TP documentationaapostoliuk
Rewritten the L2TP documentation Added the example 'PPPoE over L2TP' to blueprints (cherry picked from commit 4dd84a7c4d784229209eeb4b0d72457b094e08ce)
2024-02-08T5971: Added PPP options documentationaapostoliuk
Added PPP options documentation (cherry picked from commit dd3537443d71b8a5481ad0e8fb1a8e4edd0ecb71)
2024-02-02Changed IPv6 pool documentation in accel-ppp servicesaapostoliuk
Changed IPv6 pool documentation in accel-ppp services to named IPv6 pools. https://vyos.dev/T5865 (cherry picked from commit f5b79621d0c841ee9a596543a05ad1acc9130c1d)
2024-01-22Updated DPD and close-action values in IPSECaapostoliuk
Changed from 'hold' to 'trap' and from 'restart' to 'start' in close-action. Changed from 'hold' to 'trap' in DPD action. (cherry picked from commit cfb7e8186d83e45092f361f9717c9542bfad053b)
2023-12-30accel-ppp: T5688: Changing CLI to create client address poolaapostoliuk
Changing CLI to create client address pool (cherry picked from commit 1096cbcf95f96334d773ab98cce9d26d311f9e51)
2023-12-02vpn: update site2site VTI exampleChristian Breunig
(cherry picked from commit 0429c317884d8951cbf2e432981edeacd426f3ed)
2023-11-24ipsec: gre: use dummy interface in example over loopbackChristian Breunig
(cherry picked from commit 5953d6f69748c82cbd9eafbe662163924ae719e6)
2023-09-04correction of ipsec compression syntax and added a referencesrividya0208
for changes done for zone based firewall
2023-06-13corrected the l2tp op commandsrividya0208
2023-05-20Update openconnect.rst correct code-blockRobert Göhler
2023-05-19ocserv: fix: indent of warning section text overflowing outside the warning boxJamie Austin
2023-05-17T3896: ocserv: openconnect: document identity based configurationJamie Austin
2023-02-26tunnel: T5034: migrate "multicast enable" CLI node to enable-multicastChristian Breunig
2023-02-05Change IPsec authentication PSK and examplesViacheslav Hletenko
2023-01-31fix build warnings and errorsrebortg
2023-01-29T4958: ocserv: openconnect: document RADIUS accountingJamie Austin
2023-01-19ipsec: T4925: Added PRF information in IPSEC documentationaapostoliuk
Added Pseudo-Random Functions (PRF) information in IPSEC documentation.
2023-01-03fix closeaction imagerebortg
2023-01-02close-action: image reference is modified from image to figuresrividya0208
2022-12-27close-action: added an image to the details.srividya0208
There was a typo in the reference for the image added in the previous commit, corrected that.
2022-12-26ipsec_closeaction: added recommendation for closeaction optionssrividya0208
Added VPN IPSec connection-type recommendation for the close-action and dpd settings. For example close-action restart should not be added on both peers
2022-12-11T4792: add initial documentation for SSTP clientChristian Poessinger
2022-11-08Modified the documentation as per the new format/syntaxsrividya0208
2022-09-29ipsec: T4118: Change IPSec syntaxViacheslav Hletenko
Migration and Change boolean nodes "enable/disable" to disable-xxxx, enable-xxxx and just xxx for VPN IPsec configurations - IKE changes: - replace 'ipsec ike-group <tag> mobike disable' => 'ipsec ike-group <tag> disable-mobike' - replace 'ipsec ike-group <tag> ikev2-reauth yes|no' => 'ipsec ike-group <tag> ikev2-reauth' - ESP changes: - replace 'ipsec esp-group <tag> compression enable' => 'ipsec esp-group <tag> compression' - PEER changes: - replace: 'peer <tag> id xxx' => 'peer <tag> local-id xxx' - replace: 'peer <tag> force-encapsulation enable' => 'peer <tag> force-udp-encapsulation' - add option: 'peer <tag> remote-address x.x.x.x' If peer name is IPv4 or IPv6 address add remote-address via migration script
2022-09-08ipsec-interface: syntax correctionsrividya0208
The command to set the vpn interface is changed in the rolling release which is not modified in many configuration examples, corrected syntax in all pages where it is mentioned
2022-08-05openconnect: Fixed gramma mistake in commandsaapostoliuk
Fixed gramma mistake in commands