summaryrefslogtreecommitdiff
path: root/docs/configuration
AgeCommit message (Collapse)Author
4 daysopenvpn: T9386: AEAD fallback ciphers can't be used with shared-secret-keyAntonio Quartulli
Note that "encryption data-ciphers-fallback" only takes CBC ciphers together with "shared-secret-key".
6 daysrouter-advert: T9413: suppress linter on NAT64 well-known prefix examplesRobert Navarro
The two nat64prefix examples use the well-known prefix 64:ff9b::/96, which the doc linter reports as outside the documentation ranges. Wrap them in stop/start_vyoslinter markers, as AGENTS.md describes for this prefix, so the page passes the linter.
6 daysrouter-advert: T9413: document no-remove-on-exit and no-flush-* optionsRobert Navarro
Document the three per-interface options added in vyos-1x for T9413, which keep radvd from sending zero-lifetime router, RDNSS and DNSSL advertisements on shutdown, and add an example of two routers sharing fe80::1 as the RA source address through VRRP.
6 daysMerge pull request #2324 from mandelbitdev/T9370-openvpn-chacha20poly1305Christian Breunig
openvpn: T9370: document the chacha20poly1305 data cipher
7 dayscontainer: document remaining per-container options and network types (#2244)Ruben Herold
* container: document remaining per-container options and network types The container page covered 44 of the 53 nodes in container.xml.in. Add the eight that were missing, grouped where they belong on the page: - allow-host-cgroups, next to allow-host-pid - network <net> mac, next to the network address option - volume <vol> propagation, with all six modes - stop-timeout, next to restart - shared-memory, next to memory - network <net> type bridge / type macvlan mode / type macvlan parent The network type is the notable gap: MACVLAN was entirely undocumented, although it is the way to put containers directly on a parent network instead of behind the host bridge and NAT. The page now states that parent and mode are both required, that the parent must exist, and that MACVLAN networks cannot be assigned to a VRF - all three are enforced by verify() in src/conf_mode/container.py. Defaults and ranges are taken from container.xml.in; the "--cgroupns host" note matches what the quadlet generator emits. * container: describe volume propagation in terms of mount events The six propagation modes were described in terms of sub-mount visibility, taken from the <description> text in container.xml.in. That is not what the modes do - mount(2)/umount(2) event propagation is. Per mount_namespaces(7): - MS_SHARED propagates events *both ways* between members of the peer group, not only from the original mount to the replica - MS_PRIVATE propagates no events out of or into the mount; it does not hide sub-mounts within it Also note the constraint the host side imposes, which is easy to trip over: per docker-run(1)/podman, shared propagation requires the source mount to be shared and slave requires it to be shared or slave, or the requested mode silently does not take effect. Added the findmnt invocation to check it. Raised by CodeRabbit on #2244. * container: document stop-timeout range and MACVLAN private mode precisely
7 daysdocs: T9200: note no-ipv6-auto-ra doesn't stop already-active RA (#2195)Ruben Herold
* docs: T9200: note no-ipv6-auto-ra doesn't stop already-active RA no-ipv6-auto-ra only prevents future RA initiation; it doesn't retroactively silence router advertisements already sent on an established session. Confirmed on VyOS 1.5.1: neither a soft nor a hard clear/reset bgp on the neighbor stopped it. Per FRR's bgp_zebra_terminate_radv()/upstream PR FRRouting/frr#19487, that only runs when the neighbor's remote-as is removed and re-added. * docs: T9200: distinguish blast radius of the two RA workarounds remote-as re-add only affects the one neighbor; a bgpd/frr restart clears every BGP session on the router. The note listed them as equivalent options - reframe the restart as a maintenance-window fallback instead. Flagged by CodeRabbit review on PR #2195. * Make the note less wordy --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
12 daysopenvpn: T9370: document the chacha20poly1305 data cipherAntonio Quartulli
Add chacha20poly1305 to "encryption data-ciphers" and "encryption data-ciphers-fallback".
2026-09-28openvpn: T9364: document the mtu optionAntonio Quartulli
Document "interfaces openvpn <interface> mtu", its 1420 bytes default with DCO and its constraints.
2026-09-28T8882: add ntp polling optionsScott Laird
2026-09-28docs: Update IP page to VyOS 1.5 standards (#2255)LiudmylaNad
2026-09-28T9274: Add telegraf agent configuration (#2238)Michael
Added documentation to correspond to the change to make several agent values configurable instead of hardcoded
2026-09-28docs: T9122: clarify flow-accounting source-interface must belong to the VRF ↵LiudmylaNad
(#2252)
2026-09-28docs: Update FRR page to VyOS 1.5 standards (#2251)LiudmylaNad
* docs: Update FRR page to VyOS 1.5 standards * Minor corrections * Update frr.md
2026-09-28docs: Update Host name page to VyOS 1.5 standards (#2254)LiudmylaNad
2026-09-28docs: Update Serial console page to VyOS 1.5 standards (#2250)LiudmylaNad
* docs: Update Serial console page to VyOS 1.5 standards * Remove a passage with outdated information --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-28docs: Cleaned up container document (#2197)Diekos
* Cleaned up container document Added more explicit explanation to some items Added note on Global State Policies and container networks about accept-invalid * Update docs/configuration/container/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/container/index.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Update docs/configuration/container/index.md Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Update docs/configuration/container/index.md Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> * Added suggested fixes from coderabbit. * Fixed opmode for Adguard Home * Fix health-check retry command * Fixed the adguard example add container image fence and changed the wording around directories. * Fixed line exceeds 80 char at volume mount Fixed fences * Update docs/configuration/container/index.md No idea how that ended up in the file. Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Fix grammar for Zabbix example * Remove a third-party service example --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com> Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-28docs: T9175: document dns forwarding options security-status-poll-domain (#2193)Ruben Herold
* docs: T9175: document dns forwarding options security-poll-suffix Document the new opt-in `service dns forwarding options security-poll-suffix` setting that controls the PowerDNS recursor's periodic security status poll, disabled by default. * docs: T9175: fix security-poll-suffix placement and clarify disable The security-poll-suffix cfgcmd was placed under "Per-domain forwarding" even though it's a global forwarding option, and used the "forwarding options" convention (bold summary + Example block) used by ecs-add-for/ecs-ipv4-bits/edns-subnet-allow-list right above it. Also documents how to disable polling again (delete the option), clarifies it only takes effect with a non-empty suffix, and that secpoll.powerdns.com is PowerDNS' own poll domain rather than a VyOS default. Switches secpoll.powerdns.com from double to single backticks, matching MyST inline-code convention. Flagged by CodeRabbit and the Claude review bot on PR #2193. * docs: T9175: rename security-poll-suffix option to security-status-poll-domain Follows vyos-1x PR #5389 rename per dmbaturin's review: the value is a full FQDN, not a suffix, and the poll checks for known vulnerabilities.
2026-09-25docs: T9157: document firewall fib-type match (#2186)Ruben Herold
* docs: T9157: document firewall fib-type match Companion doc entry for vyos/vyos-1x#5372, which adds "fib-type" as a source/destination match option (nftables' fib daddr/saddr type expression) for forward/input/output/name rule sets, ipv4 and ipv6. * docs: T9157: update fib match docs for fib-type -> fib type rename Companion vyos-1x PR #5372 restructured the "fib-type" leaf into a "fib" node with a "type" child (following feedback from l0crian1 and sarthurdev to reserve the "fib" namespace for a possible future lookup/match concatenation feature, tracked separately under T5119). Update the CLI paths and examples here to match, and fix "prohibited" to "prohibit" to match nftables' actual fib_addrtype token. * docs: T9157: add prerouting raw fib type reference, fix backtick style CodeRabbit feedback on #2186: - the prose showed a "prerouting raw" example but the command reference only listed forward/input/output/name filter forms, even though fib.xml.i is also included from common-rule-ipv{4,6}-raw.xml.i for that hook. Add the missing source/destination cfgcmd entries. - MyST pages use single backticks for inline code, not double (that's for embedded RST); fix the fib type prose accordingly. * docs: T9157: update fib docs for rule-level lookup/match split Companion vyos-1x PR #5372 moved "fib" from a leaf nested under destination/source to a rule-level node with separate "lookup" (source-address/destination-address) and "match route-type" children, per l0crian1's review feedback - reserving room for mark/iif/oif lookup keys and oif/oifname match results later (tracked under T5119) without ever renaming what ships now. Update the CLI paths and examples here to match.
2026-09-15firewall/groups: document include option and remote-group interval (#2241)Ruben Herold
* firewall/groups: document include option and remote-group interval These CLI nodes existed in the XML definitions but were missing from the docs entirely, per docs.vyos.io/en/1.5/coverage.html: - include: lets one group nest another group of the same type (address-group, ipv6-address-group, network-group, ipv6-network-group, mac-group, port-group, interface-group) - remote-group interval: overrides the global resolver-interval on a per-group basis * firewall/groups: clarify remote-group interval range applies post-conversion CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py: human_to_seconds() converts the value first, then the range check runs on the converted seconds -- so e.g. "30s" is rejected same as "30".
2026-09-11docs: T8045: document dont-query (#2211)chariri
* docs: T8045: document dont-query --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-11docs: Update sFlow page to VyOS 1.5 standards (#2237)LiudmylaNad
* docs: Update sFlow page to VyOS 1.5 standards
2026-09-11data-ciphers-fallback must required for s2s (#2235)srividya0208
2026-09-11docs: Update Conntrack page to VyOS 1.5 standards (#2232)LiudmylaNad
* docs: Update Conntrack page to VyOS 1.5 standards * Update conntrack.md * Apply suggestion from @dmbaturin * Apply suggestion from @dmbaturin * Apply suggestion from @dmbaturin * Apply suggestion from @dmbaturin --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-11docs: Update Acceleration page to VyOS 1.5 standards (#2231)LiudmylaNad
* docs: Update Acceleration page to VyOS 1.5 standards * Apply batched suggestions from code review Co-authored-by: Daniil Baturin <daniil@baturin.org> * Update acceleration.md --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-11Merge pull request #2210 from cqjjjzr/T9166-ipv6-haViacheslav Hletenko
docs: T9166: document IPv6 for HA peer link
2026-09-11firewall: T9076: document remote-group update interval (#2148)BradKollmyer
* firewall: T9076: document remote-group update interval Document the new 'set firewall group remote-group <name> interval' command: per-group update interval from 60 seconds to 4 weeks, given as plain seconds or with s/m/h/d/w suffixes (e.g. 4h), falling back to the global resolver-interval when unset. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * firewall: T9076: note URL quoting and log redaction for remote-group Warn that remote-group URLs with query strings must be quoted (unquoted '&' silently truncates the value; literal '?' may need Ctrl-V, see T9077) and that vyos-domain-resolver logs redact the query string on download failures (T8829). Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> * firewall: T9076: note that remote-group interval suffixes may be combined Address review feedback: document that s/m/h/d/w units can be stacked (e.g. 1h30m), matching human_to_seconds and the CLI regex. --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
2026-09-09docs: Update Monitoring page to VyOS 1.5 standards (#2207)LiudmylaNad
* docs: Update Monitoring page to VyOS 1.5 standards --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-09docs: Update SNMP page to VyOS 1.5 standards (#2222)LiudmylaNad
* docs: Update SNMP page to VyOS 1.5 standards --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-09docs: Update PPPoE server page to VyOS 1.5 standards (#2223)LiudmylaNad
* docs: Update PPPoE server page to VyOS 1.5 standards * Update pppoe-server.md * Update pppoe-server.md * Clarify the meaning of `noauth` --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-09docs: Update NTP page to VyOS 1.5 standards (#2224)LiudmylaNad
* docs: Update NTP page to VyOS 1.5 standards
2026-09-09docs: Update Flow accounting page to VyOS 1.5 standards (#2236)LiudmylaNad
* docs: Update Flow accounting page to VyOS 1.5 standards * Minor corrections * Minor corrections * Update flow-accounting.md * Apply batched suggestions from code review docs: Applied review suggestions to the Flow accounting page Co-authored-by: Daniil Baturin <daniil@baturin.org> * Remove the passage about address family match requirements --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-09-01Merge pull request #2162 from alexandr-san4ez/T5735-rollingChristian Breunig
T5735: Add service stunnel documentation
2026-09-01T5735: Add service stunnel documentationOleksandr Kuchmystyi
Add a new configuration page for the stunnel service.
2026-08-24docs: T9145: document WLB health script variablesJeleel Muibi
2026-08-21Merge pull request #2153 from alexandr-san4ez/T8868-rollingViacheslav Hletenko
kdump: T8868: Add documentation for kernel crash dump feature
2026-08-19T9229: adds documentation for sys-rawioopswill
2026-08-16docs: T9166: document IPv6 for HA peer linkchariri
2026-08-14docs: igmp-proxy: document firewall requirements and operational commands ↵JR L.
(#2174) Co-authored-by: JR Lanteigne <dniminenn@users.noreply.github.com>
2026-08-14 docs: Update LLDP page to VyOS 1.5 standards (#2192)LiudmylaNad
* docs: Update LLDP page to VyOS 1.5 standards * Update lldp.md
2026-08-14docs: Update IPoE server page to VyOS 1.5 standards (#2191)LiudmylaNad
* docs: Update IPoE server page to VyOS 1.5 standards * Minor corrections * Update ipoe-server.md
2026-08-14docs: T9159: document service ntp source-address option (#2185)Ruben Herold
* docs: T9159: document service ntp source-address option Companion doc entry for the vyos-1x change adding "set service ntp source-address <address>" (chrony's bindacqaddress). * docs: T9159: document service ntp source-interface option Companion doc entry for the vyos-1x change adding "set service ntp source-interface <interface>" (chrony's bindacqdevice), addressing multi-VRF feedback on T9159. * docs: T9159: clarify source-interface is scoped to a single VRF The source-interface description implied it helps disambiguate across multiple VRFs at once, but service ntp vrf already binds the whole NTP client to a single VRF - source-interface only picks the egress device within that one VRF. Flagged by CodeRabbit review on PR #2185.
2026-08-14 docs: Update BGP page to VyOS 1.5 standards (#2111)LiudmylaNad
* docs: Update BGP page to VyOS 1.5 standards * Update bgp.md * Apply suggestions from code review Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Daniil Baturin <daniil@baturin.org> * Apply suggestions from code review Co-authored-by: LiudmylaNad <l.nadolina@vyos.io> * Update bgp.md * Fix a few factual issues and improve the wording Co-authored-by: Daniil Baturin <daniil@baturin.org> * Apply style suggestions from code review Co-authored-by: Daniil Baturin <daniil@baturin.org> * Re-added the closing ``` at line 2289 that the CI bot flagged. No content change --------- Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com> Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-08-11-fixes spellingNicolas Vollmar
2026-08-11T9184: adds documentation for chown and other missing optionsNicolas Vollmar
2026-08-06docs: Update mDNS Repeater page to VyOS 1.5 standards (#2177)LiudmylaNad
* docs: Update mDNS Repeater page to VyOS 1.5 standards * Minor corrections
2026-08-04docs: Update Conntrack sync page to VyOS 1.5 standards (#2147)LiudmylaNad
* docs: Update Conntrack sync page to VyOS 1.5 standards * Minor corrections * Update conntrack-sync.md * Use "active/backup" terminology consistent with official conntrackd docs Co-authored-by: Daniil Baturin <daniil@baturin.org> --------- Co-authored-by: Daniil Baturin <daniil@baturin.org>
2026-08-04 docs: Update DNS forwarding page to VyOS 1.5 standards (#2163)LiudmylaNad
* docs: Update DNS forwarding page to VyOS 1.5 standards * Update dns.md * Update dns.md
2026-08-04 docs: Update Dynamic DNS page to VyOS 1.5 standards (#2164)LiudmylaNad
* docs: Update Dynamic DNS page to VyOS 1.5 standards
2026-08-04 docs: Update DHCP Relay page to VyOS 1.5 standards (#2146)LiudmylaNad
2026-08-04 docs: Update Router Advertisements page to VyOS 1.5 standards (#2132)LiudmylaNad
* docs: Update Router Advertisements page to VyOS 1.5 standards
generated by cgit v1.2.3 (git 2.39.1) at 2026-10-13 17:02:42 +0000