| Age | Commit message (Collapse) | Author |
|---|
|
The node is gone from the CLI, so example configuration dumps which still
show it no longer match what a reader sees on their own system. Remove it
from the shown output only; no prose changes. The comparison shown on the
testing page is rewritten rather than trimmed, as deleting the lines would
have left an edit level behind with nothing under it.
|
|
Names are no longer derived from the hw-id node. They are bound to the slot
the hardware occupies and recorded in a mapping file, so document what
decides a name, what happens when a card is replaced or added, and how to
rename an interface.
The troubleshooting page said to pin a MAC with hw-id when interfaces were
renamed after a VM migration or a clone. That node no longer exists and the
situation it describes no longer arises, so replace it with a pointer to the
new section and a note on where to look when an interface really is missing.
|
|
* docs: T8045: document dont-query
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update sFlow page to VyOS 1.5 standards
|
|
|
|
* docs: Update Conntrack page to VyOS 1.5 standards
* Update conntrack.md
* Apply suggestion from @dmbaturin
* Apply suggestion from @dmbaturin
* Apply suggestion from @dmbaturin
* Apply suggestion from @dmbaturin
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update Acceleration page to VyOS 1.5 standards
* Apply batched suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Update acceleration.md
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
docs: T9166: document IPv6 for HA peer link
|
|
* firewall: T9076: document remote-group update interval
Document the new 'set firewall group remote-group <name> interval'
command: per-group update interval from 60 seconds to 4 weeks, given
as plain seconds or with s/m/h/d/w suffixes (e.g. 4h), falling back
to the global resolver-interval when unset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* firewall: T9076: note URL quoting and log redaction for remote-group
Warn that remote-group URLs with query strings must be quoted (unquoted
'&' silently truncates the value; literal '?' may need Ctrl-V, see
T9077) and that vyos-domain-resolver logs redact the query string on
download failures (T8829).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* firewall: T9076: note that remote-group interval suffixes may be combined
Address review feedback: document that s/m/h/d/w units can be stacked
(e.g. 1h30m), matching human_to_seconds and the CLI regex.
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
|
* docs: Update Monitoring page to VyOS 1.5 standards
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update SNMP page to VyOS 1.5 standards
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update PPPoE server page to VyOS 1.5 standards
* Update pppoe-server.md
* Update pppoe-server.md
* Clarify the meaning of `noauth`
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update NTP page to VyOS 1.5 standards
|
|
* docs: Update Flow accounting page to VyOS 1.5 standards
* Minor corrections
* Minor corrections
* Update flow-accounting.md
* Apply batched suggestions from code review
docs: Applied review suggestions to the Flow accounting page
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Remove the passage about address family match requirements
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
docs: add Google Cloud HA VPN BGP example
|
|
T5735: Add service stunnel documentation
|
|
Add a new configuration page for the stunnel service.
|
|
|
|
|
|
kdump: T8868: Add documentation for kernel crash dump feature
|
|
|
|
|
|
(#2174)
Co-authored-by: JR Lanteigne <dniminenn@users.noreply.github.com>
|
|
* docs: Update LLDP page to VyOS 1.5 standards
* Update lldp.md
|
|
* docs: Update IPoE server page to VyOS 1.5 standards
* Minor corrections
* Update ipoe-server.md
|
|
* docs: T9159: document service ntp source-address option
Companion doc entry for the vyos-1x change adding
"set service ntp source-address <address>" (chrony's bindacqaddress).
* docs: T9159: document service ntp source-interface option
Companion doc entry for the vyos-1x change adding
"set service ntp source-interface <interface>" (chrony's
bindacqdevice), addressing multi-VRF feedback on T9159.
* docs: T9159: clarify source-interface is scoped to a single VRF
The source-interface description implied it helps disambiguate
across multiple VRFs at once, but service ntp vrf already binds the
whole NTP client to a single VRF - source-interface only picks the
egress device within that one VRF.
Flagged by CodeRabbit review on PR #2185.
|
|
* docs: Update BGP page to VyOS 1.5 standards
* Update bgp.md
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply suggestions from code review
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
* Update bgp.md
* Fix a few factual issues and improve the wording
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply style suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Re-added the closing ``` at line 2289 that the CI bot flagged. No content change
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
|
|
|
|
* docs: clarify Proxmox Cloud-Init user setup
* docs: address Proxmox example lint feedback
---------
Co-authored-by: Jeleel Muibi <jeleel-muibi@users.noreply.github.com>
|
|
* docs: Update mDNS Repeater page to VyOS 1.5 standards
* Minor corrections
|
|
* docs: upgrade vendored DataTables 1.11.5 -> 2.3.8
Swap the vendored single-component DataTables downloader build from 1.11.5
to 2.3.8 (docs/_static/js/datatables.js, docs/_static/css/datatables.css).
The only init site, docs/_static/js/tables.js, uses the option-less
jQuery-style $('#id').DataTable() form, which is unchanged in 2.x, so
neither it nor docs/_templates/layout.html needed edits. jQuery 3.6.0 is
still injected ahead of the bundle by sphinxcontrib-jquery and satisfies
2.x.
Remove docs/_static/css/DataTables-1.11.5/ (10 sort-icon images). 2.x draws
sort indicators in pure CSS: the new datatables.css contains no url()
references at all, and the replaced 1.11.5 stylesheet was the only thing in
the repo that referenced those files.
Migrate custom selectors for the 2.x generated-class renames, each verified
against the downloaded bundle rather than assumed:
- .dataTables_info -> .dt-info (tables.css, text.css)
- .paginate_button -> .dt-paging-button (tables.css, text.css)
- #coverage a.paginate_button{,.current,.next,.previous}
-> #coverage button.dt-paging-button{...}
2.x renders paging controls as <button> (was <a> in 1.x), so the old
rules failed on both element type and class. The .current/.next/
.previous modifiers are still emitted and are retained.
The #table-cfgcmd_wrapper / #table-opcmd_wrapper rules are deliberately
untouched: only the wrapper *class* changed (dataTables_wrapper ->
dt-container); the element id is still <tableId>_wrapper.
Drop the CodeQL exclusion (.github/codeql/codeql-config.yml, plus the
optional codeql-cfg-path input in .github/workflows/codeql.yml). That
config existed solely to paths-ignore the 1.11.5 bundle, which tripped 7
alerts (5x js/incomplete-multi-character-sanitization, 2x
js/incomplete-sanitization). Upstream 2.x hardened the implicated helpers -
_stripHtml now runs a do/while fixpoint over the <script> strip, and
_escapeHtml uses all-global regexes - so those patterns are not expected to
recur. Removing the exclusion restores default CodeQL coverage of the file;
this PR's own CodeQL run is the empirical test.
Provenance (DataTables downloader builder, styling "DataTables default",
component set dt only - the 2.x equivalent of the previous #dt/dt-1.11.5):
https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.js
sha256 184fb4bd0b9a81a955acd608ba94d0643c74271e78c0fae30f1f40b824f88b1d
https://cdn.datatables.net/v/dt/dt-2.3.8/datatables.css
sha256 e37677437e0fbe4a463aafc83bc4ea8d60986b72050ba9f47f740b41148184ae
Verified with a local make html: build succeeded, and coverage.html renders
both tables (table-cfgcmd 9095 rows, table-opcmd 3036 rows) with the 2.3.8
assets injected in the correct order after jQuery.
🤖 Generated by [robots](https://vyos.io)
* docs: simplify paging-button hover background to one declaration
The hover rule carried 'background-color: #E1E4E5 !important' followed by
'background: none'. The important longhand outranks the later normal-importance
shorthand, so the gray hover fill did apply — but the pair is confusing and
CodeRabbit read it as a dead declaration. Collapse to a single
'background: #E1E4E5 !important', which produces the identical effective state
(gray fill, upstream 2.x hover gradient suppressed) in one declaration.
🤖 Generated by [robots](https://vyos.io)
* docs: re-target mobile search-input margin at the 2.x sibling DOM
DataTables 1.x nested the search <input> inside its <label>; 2.x renders them
as siblings inside div.dt-search, so the narrow-viewport descendant rule
'label input' no longer matched and the 10px top margin was silently lost
below 576px. Target '.dt-search input' instead. Flagged independently by the
implementation pass and both adversarial reviewers (Codex + agy).
🤖 Generated by [robots](https://vyos.io)
|
|
* docs: Update Conntrack sync page to VyOS 1.5 standards
* Minor corrections
* Update conntrack-sync.md
* Use "active/backup" terminology consistent with official conntrackd docs
Co-authored-by: Daniil Baturin <daniil@baturin.org>
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update DNS forwarding page to VyOS 1.5 standards
* Update dns.md
* Update dns.md
|
|
* docs: Update Dynamic DNS page to VyOS 1.5 standards
|
|
|
|
* docs: Update Router Advertisements page to VyOS 1.5 standards
|
|
* docs: Update HTTP API page to VyOS 1.5 standards
* Clarify the wording about self-signed certificates
* Fix unsual wording regarding DH parameters configuration
* Update https.md
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
|
|
* docs(Installation): Remove outdated portal link and Proxmox/KVM cloud-init note
* Update install.md
|
|
* security: remediate CodeQL code-scanning alerts (picker XSS sinks, test sanitization, vendored DataTables exclusion)
Remediates all 11 open CodeQL alerts on the default branch:
- version-picker.js (js/xss-through-dom, alerts 1-3): percent-encode every
DOM-derived path component (select.value, parsed location segments) at URL
construction time via encodePath()/langUrlFor(), and tighten the
parseLocation slug charset to [A-Za-z0-9._-]. No-op on legitimate sphinx
slugs — URLs stay byte-identical (asserted by tests).
- workers/apex/test/manifest.test.ts (js/incomplete-multi-character-
sanitization, alert 6): strip HTML comments from the root.html fixture
repeatedly to a fixpoint instead of a single pass.
- docs/_static/js/datatables.js (alerts 4,5,7-11): excluded from CodeQL
analysis via .github/codeql/codeql-config.yml (new codeql-cfg-path input
to the fleet reusable workflow). The file is vendored stock DataTables
1.11.5; the flagged helpers are display/sort normalization, not
sanitization boundaries. Excluding keeps the vendored copy byte-identical
to upstream instead of hand-patching it.
Adds 9 picker tests (hostile-input encoding + slug-charset accept/reject);
workers suite 103/103 green.
🤖 Generated by [robots](https://vyos.io)
* security: normalize pre-existing percent escapes in encodePath
Adversarial-review finding (Codex, medium): location.pathname returns
well-formed escapes verbatim, so blind encodeURIComponent double-encoded
them (%2E -> %252E), broke the HEAD probe on escaped deep links, and
dumped the user at the version root. Each segment is now decoded first
(malformed escapes keep the raw segment — no throw), then re-encoded to
canonical single encoding. Decoding cannot resurrect dot-segments:
the URL parser resolves '.'/'..' and their percent-encoded forms during
navigation, so pathname never presents them (verified against the WHATWG
parser in Node).
workers suite 106/106 (+2 regression tests, mutation-verified).
🤖 Generated by [robots](https://vyos.io)
* security: normalize percent escapes per run, not per segment
Round-2 adversarial finding (Codex, medium): whole-segment decode meant
one malformed escape (a%20b%zz) threw for the segment and double-encoded
the valid escapes beside it. encodeSegment now decodes+re-encodes each
well-formed %HH run independently; literal spans (including a bare '%')
always pass through encodeURIComponent, so taint neutralization holds
unconditionally; a run decoding to invalid UTF-8 stays verbatim (already
pure %HH text).
workers suite 108/108 (+2 discriminating regression tests).
🤖 Generated by [robots](https://vyos.io)
|
|
`docs/superpowers/` holds Claude Code plugin-generated internal design
specs and plans, not user documentation. Adding `superpowers` to
`exclude_patterns` guards against Sphinx ever picking the directory up
and publishing it should it reappear in the source tree.
Guard only — the content itself was already removed in 3ab97e71 and
abb8be5b.
|
|
Introduced the kdump section detailing its purpose and functionalities.
|
|
vyos-api: fill automation API doc gaps (T9087–T9092)
|
|
* docs: Update Event handler page to VyOS 1.5 standards
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
* docs: update flowtable and ethernet/bonding documentation
* Removing Netfilter word and add the identification of the interfaces to use FlowTables
* Fixed warning from commit:c433e15
* Update docs/configuration/firewall/flowtables.md
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update docs/configuration/firewall/flowtables.md
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update docs/configuration/firewall/flowtables.md
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update docs/configuration/firewall/flowtables.md
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* cfgmc structure and sub-interface offload fixed
* Fixed conflicts on flowtable documentation
* revert ethernet.md and fixed the latest infos
* added subsection to the checks section to show offloaded traffic for sub-interfaces
* Final changes
* Changed conntrack -L to VyOS command
* Replacing new output description with VyOS command
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
Convert the multi-field-node table to wrapped list items per the 80-char
docs guideline, and rework the bulk-apply bullet to reconcile state
before retrying after a timeout instead of recommending blind retries.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Only port/port-group require protocol in the same request; description
alone is fine on an existing rule but fails on a rule no request has
created yet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Batch sizing, geoip/remote-group commit cost, the 1 MB
request-body-size-limit, and commit-confirm as a remote safety net.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
|
Document that an operation list commits as one transaction whose error
may not identify the failing op (bisect / one-op fallback), and that
/configure rejects {"op": "save"} — persistence goes through
/config-file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
|
