| Age | Commit message (Collapse) | Author |
|---|
|
build-kernel.sh only builds the kernel. The build.py wrapper in
scripts/package-build/linux-kernel installs the build dependencies,
fetches and verifies the kernel source, builds the kernel and all
firmware and out-of-tree modules defined in package.toml.
- Document build.py usage and its --packages and
--install-dependencies options.
- Update paths from packages/linux-kernel to
scripts/package-build/linux-kernel and from data/defaults.json to
data/defaults.toml; drop references to the removed Jenkinsfile.
- Update the out-of-tree module list to match package.toml.
- Drop the per-module build instructions which referenced renamed or
removed helper scripts, and the no longer existing ADD_FW_FILES.
|
|
|
|
On macOS a Docker volume must be used instead of a bind mount from
the user's home. Also warn about case-insensitive macOS file systems
which break Linux kernel source checkouts.
|
|
The inlined Docker installation steps go stale with every Docker
release. Link to the upstream Debian installation guide instead.
|
|
The prerequisites assumed an existing vyos-build checkout, but the
repository was only cloned in the "Build ISO" section, and the native
build section showed build commands under a "clone" heading.
- Add a "Get the Source Code" step at the start of the prerequisites
and drop the duplicate clones from "Build from source" and
"Build ISO".
- List Docker before the native build, as it is the recommended way.
- Native build now refers to the "Build ISO" commands.
- Rename the ISO "Packages" subsection to "Custom Packages" and move
the build_custom_packages label to it, as referenced from "Install".
- Group "ISO Build Issues" and the APT verbosity patch under
"Troubleshooting".
- Minor fixes: MyST inline code, list lead-in, kernel checkout path,
stale VyOS 1.3 comment.
|
|
* docs: Update Firewall bridge page to VyOS 1.5 standards
* Apply wording and formatting suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
secure-boot: T9496: document Secure Boot signature check on "add system image"
|
|
docs: document Azure forwarding prerequisites
|
|
* docs: T3871: describe how interface names are assigned
Names are no longer derived from the hw-id node. They are bound to the slot
the hardware occupies and recorded in a mapping file, so document what
decides a name, what happens when a card is replaced or added, and how to
rename an interface.
The troubleshooting page said to pin a MAC with hw-id when interfaces were
renamed after a VM migration or a clone. That node no longer exists and the
situation it describes no longer arises, so replace it with a pointer to the
new section and a note on where to look when an interface really is missing.
* docs: T3871: drop hw-id from the example output
The node is gone from the CLI, so example configuration dumps which still
show it no longer match what a reader sees on their own system. Remove it
from the shown output only; no prose changes. The comparison shown on the
testing page is rewritten rather than trimmed, as deleting the lines would
have left an edit level behind with nothing under it.
|
|
With Secure Boot enabled, "add system image" now aborts if the Linux Kernel
of the new image is not signed by an enrolled Machine Owner Key, since that
image would not boot. Describe the check, its error message and when it is
skipped, and point to it from the image update page.
|
|
vpn: document disable-mobike, disable-uniqreqids, eap-id and L2TP IPs…
|
|
vpp: T9312: sFlow is supported on physical interfaces only
|
|
docs: Update Firewall groups page to VyOS 1.5 standards
|
|
|
|
|
|
* docs: Update Firewall global options page to VyOS 1.5 standards
* Update global-options.md
|
|
* docs: Update Firewall page to VyOS 1.5 standards
* Apply suggestion from @github-actions[bot]
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update docs/configuration/firewall/index.md
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update index.md
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
docs: Ansible example - upgrades with vyos.blueprints
|
|
ruben-herold/docs-openvpn-fix-pool-subnet-mask-hash
openvpn: fix client-ip-pool subnet-mask command name and list all has…
|
|
|
|
|
|
|
|
haproxy: T9097: document backend ssl checks-only option
|
|
|
|
Enrolling a MOK is only needed for development with custom signed images.
Official LTS images ship officially signed binaries and boot out of the
box.
|
|
container: T9453: explain migration to kernel overlayfs from fuse-overlayfs
|
|
haproxy: document backend http-server-close
|
|
|
|
|
|
T6304: Update commit-archive to the structured CLI
|
|
T9354: document "reconnect interface" operational command
|
|
|
|
T861: secure-boot: document show secure-boot op-mode commands
|
|
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
* docs: T8887: backfill Phase 1 commands from recent vyos-1x additions
Documents six CLI features added to vyos-1x between Nov 2025 and May 2026
that were missing from the docs (gap-audit T8886, Phase 1 / T8887):
- policy route-map match source-peer (vyos-1x#5149, T8588)
- high-availability vrrp snmp trap (vyos-1x#5108, T8448)
- protocols segment-routing traffic-engineering subtree (vyos-1x#4994, T6750)
- protocols bgp bmp target monitor pre-policy/post-policy/local-rib
(vyos-1x#4922, T8133)
- firewall global-options geoip provider/maxmind-* (vyos-1x#4949, T7926/T8049)
- vpn ipsec childless IKE SA option (vyos-1x#4930, T8136)
system frr watchfrr-timeout and service router-advert prefix
base-interface are now documented on rolling via the page rewrites in
vyos-documentation#2251 and vyos-documentation#2132. protocols bgp
parameters as-notation is deferred: rolling carries it commented out;
to be handled in a follow-up.
🤖 Generated by [robots](https://vyos.io)
* docs: T8887: wrap pre-existing overlong lines in touched files
- route-map, ipsec_general: wrap five pre-existing overlong lines so the
doc linter (which scans whole modified files) passes on touched files
🤖 Generated by [robots](https://vyos.io)
* docs: T8887: document BMP prerequisites and mandatory target address
- state that set system frr bmp needs a commit plus a router reboot (or
FRR restart) before BMP targets can be committed (protocols_bgp.py
verify)
- add target address (mandatory) and port (default 5000) commands and
include the address in the example
🤖 Generated by [robots](https://vyos.io)
* docs: T8887: state SR-TE segment-list commit requirements
Per protocols_segment-routing.py verify(): a segment list needs at least
one index; each index needs an MPLS label or a NAI; an adjacency NAI
needs both source- and destination-identifier; a prefix identifier
needs an algorithm; IS-IS/OSPF import, adjacency/prefix, IPv4/IPv6 and
spf/strict-spf are mutually exclusive. Add a complete example.
🤖 Generated by [robots](https://vyos.io)
* docs: T8887: escape placeholders in GeoIP and childless cfgcmd headers
🤖 Generated by [robots](https://vyos.io)
* Apply suggestions from Liydmyla
Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>
---------
Co-authored-by: Daniil Baturin <daniil@vyos.io>
Co-authored-by: LiudmylaNad <235844477+LiudmylaNad@users.noreply.github.com>
|
|
|
|
|
|
algorithms
|
|
Add an Operation section with {opcmd} entries for 'show secure-boot' and 'show
secure-boot detail', and reference it from the installation verification step.
|
|
|
|
Note that "encryption data-ciphers-fallback" only takes CBC ciphers
together with "shared-secret-key".
|
|
The two nat64prefix examples use the well-known prefix 64:ff9b::/96,
which the doc linter reports as outside the documentation ranges. Wrap
them in stop/start_vyoslinter markers, as AGENTS.md describes for this
prefix, so the page passes the linter.
|
|
Document the three per-interface options added in vyos-1x for T9413,
which keep radvd from sending zero-lifetime router, RDNSS and DNSSL
advertisements on shutdown, and add an example of two routers sharing
fe80::1 as the RA source address through VRRP.
|
|
openvpn: T9370: document the chacha20poly1305 data cipher
|
|
* container: document remaining per-container options and network types
The container page covered 44 of the 53 nodes in container.xml.in. Add
the eight that were missing, grouped where they belong on the page:
- allow-host-cgroups, next to allow-host-pid
- network <net> mac, next to the network address option
- volume <vol> propagation, with all six modes
- stop-timeout, next to restart
- shared-memory, next to memory
- network <net> type bridge / type macvlan mode / type macvlan parent
The network type is the notable gap: MACVLAN was entirely undocumented,
although it is the way to put containers directly on a parent network
instead of behind the host bridge and NAT. The page now states that
parent and mode are both required, that the parent must exist, and that
MACVLAN networks cannot be assigned to a VRF - all three are enforced
by verify() in src/conf_mode/container.py.
Defaults and ranges are taken from container.xml.in; the "--cgroupns
host" note matches what the quadlet generator emits.
* container: describe volume propagation in terms of mount events
The six propagation modes were described in terms of sub-mount
visibility, taken from the <description> text in container.xml.in. That
is not what the modes do - mount(2)/umount(2) event propagation is.
Per mount_namespaces(7):
- MS_SHARED propagates events *both ways* between members of the peer
group, not only from the original mount to the replica
- MS_PRIVATE propagates no events out of or into the mount; it does not
hide sub-mounts within it
Also note the constraint the host side imposes, which is easy to trip
over: per docker-run(1)/podman, shared propagation requires the source
mount to be shared and slave requires it to be shared or slave, or the
requested mode silently does not take effect. Added the findmnt
invocation to check it.
Raised by CodeRabbit on #2244.
* container: document stop-timeout range and MACVLAN private mode precisely
|
|
* docs: T9200: note no-ipv6-auto-ra doesn't stop already-active RA
no-ipv6-auto-ra only prevents future RA initiation; it doesn't
retroactively silence router advertisements already sent on an
established session. Confirmed on VyOS 1.5.1: neither a soft nor a
hard clear/reset bgp on the neighbor stopped it. Per FRR's
bgp_zebra_terminate_radv()/upstream PR FRRouting/frr#19487, that only
runs when the neighbor's remote-as is removed and re-added.
* docs: T9200: distinguish blast radius of the two RA workarounds
remote-as re-add only affects the one neighbor; a bgpd/frr restart
clears every BGP session on the router. The note listed them as
equivalent options - reframe the restart as a maintenance-window
fallback instead.
Flagged by CodeRabbit review on PR #2195.
* Make the note less wordy
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
|
|
|
|
|
|
|
