| Age | Commit message (Collapse) | Author |
|---|
|
* docs: update flowtable and ethernet/bonding documentation
* Removing Netfilter word and add the identification of the interfaces to use FlowTables
* Fixed warning from commit:c433e15
* Update docs/configuration/firewall/flowtables.md
* Update docs/configuration/firewall/flowtables.md
* Update docs/configuration/firewall/flowtables.md
* Update docs/configuration/firewall/flowtables.md
* cfgmc structure and sub-interface offload fixed
* Fixed conflicts on flowtable documentation
* revert ethernet.md and fixed the latest infos
* added subsection to the checks section to show offloaded traffic for sub-interfaces
* Final changes
* Changed conntrack -L to VyOS command
* Replacing new output description with VyOS command
---------
(cherry picked from commit a0067e0fbc8c3bee2af6701b3542eb013146fcf8)
Co-authored-by: jvela-dot <j.vela@vyos.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
* docs: Update Event handler page to VyOS 1.5 standards (#2130)
* docs: Update Event handler page to VyOS 1.5 standards
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit d08dbfacca29aa1e9750468293dd00910ad775ee)
* Use "event handler" styling in text and remove the mention of netplugd
since it's replaced by vyos-netlinkd in rolling already
Co-authored-by: Daniil Baturin <daniil@baturin.org>
---------
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@vyos.io>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
(#2136) (#2144)
* docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks
In DMVPN the mGRE tunnel and the IPSec protecting it are handled
independently, so GRE can be forwarded while no IPSec SA is active for a
peer (e.g. while an SA is still being negotiated or after one expires),
allowing unencrypted GRE to leave the router. This is inherent to
combining GRE with IPSec and is common to DMVPN implementations in
general.
Add a "Protecting against unencrypted traffic leaks" section to the DMVPN
reference page explaining the behaviour and recommending an output filter
rule that drops GRE not matched by an outbound IPSec policy
(ipsec match-none-out). Note that this disables unencrypted GRE on the
node entirely, so coexisting plain GRE tunnels would stop working.
Apply the same rule in the Dual HUB Dual Cloud example on the VyOS nodes.
* docs(DMVPN): reflow DMVPN documentation for line length compliance
Reformat the DMVPN guide and dual-hub dual-cloud example to wrap
long lines and improve readability without changing the documented
behavior or configuration guidance.
---------
(cherry picked from commit 50acf8f188475b0554b99a739cb8ada12d51e77b)
Co-authored-by: zdc <zdc@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
(#2178) (#2180)
(cherry picked from commit 4631db6a1578550dd4c1410a8416575899f36936)
Co-authored-by: John Estabrook <jestabro@vyos.io>
|
|
vyos-api: fill automation API doc gaps (T9087–T9092) (backport #2152)
|
|
(backport #2176) (#2179)
* docs(Installation): Remove outdated portal link and Proxmox/KVM cloud-init note
(Manual backport of Liudmyla's original for rolling)
* Break long lines in install.md to pass the linter check
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
`docs/superpowers/` holds Claude Code plugin-generated internal design
specs and plans, not user documentation. Adding `superpowers` to
`exclude_patterns` guards against Sphinx ever picking the directory up
and publishing it should it reappear in the source tree.
Guard only — the content itself was already removed in 3ab97e71 and
abb8be5b.
(cherry picked from commit a9dc16aac2a7e7a6e5e4bb1c19897b3d707ba4d1)
Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
|
|
Convert the multi-field-node table to wrapped list items per the 80-char
docs guideline, and rework the bulk-apply bullet to reconcile state
before retrying after a timeout instead of recommending blind retries.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 2510eefadc8e7520e7f85f45a2b29fdab634474a)
|
|
Only port/port-group require protocol in the same request; description
alone is fine on an existing rule but fails on a rule no request has
created yet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 9e90088827c53f8d61e82e2e29910a9346009e87)
|
|
Batch sizing, geoip/remote-group commit cost, the 1 MB
request-body-size-limit, and commit-confirm as a remote safety net.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit af04731c74b0383bc36c66addd6cc22ba41c55e0)
|
|
Document that an operation list commits as one transaction whose error
may not identify the failing op (bisect / one-op fallback), and that
/configure rejects {"op": "save"} — persistence goes through
/config-file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit f002549a5fe3ae782be8fe02160fa2796e7e0471)
|
|
showConfig returns HTTP 400 'Configuration under specified path is
empty' for schema-valid but unconfigured paths; recommend probing with
exists or treating that error as an empty subtree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 3a952350bf5b5b38a7db1208ed3c910ded7b4b24)
|
|
The /show endpoint can return the running config as flat set commands
(op-mode 'show configuration commands' equivalent) — the natural way to
mirror or back up a router over the API; previously undocumented.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit ca902d4eebd49697f476d538eadfcaeb8ebb2232)
|
|
Each /configure request is validated and committed on its own, so fields
of one node (task-scheduler executable+interval, NAT translation,
firewall action/protocol before port) must be sent in a single request.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 0b88b491d043e5f281d8e3ae499c4d045da28f28)
|
|
(cherry picked from commit 9ad380fb7a1b122a605c7562124085e3200e30f0)
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
* DOCS: Backport 2117 (Revise Console server page) to Circinus
* Update console-server.md
|
|
* docs: Update TFTP server page to VyOS 1.5 standards
* Update tftp-server.md
(cherry picked from commit 8be9ced92fdc2b12b16aae9e438884acfd387faf)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* configexamples/inter-vrf-routing-vrf-lite: fix formatting
* configexamples/inter-vrf-routing-vrf-lite: reformat text to limit line length
|
|
* docs: Update Config sync page to VyOS 1.5 standards
* Minor corrections
* Update config-sync.md
* Apply suggestion from @github-actions[bot]
* Apply suggestion from @github-actions[bot]
---------
(cherry picked from commit 228149f1a1d824b968b565f82c3ee73eb7ba489c)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
(#2108) (#2109)
On a fresh (no-consent) load the consent banner could render completely
unstyled and expand to full page height. Cookiebot delivers its dialog CSS as
a constructed stylesheet on document.adoptedStyleSheets; ReadTheDocs'
readthedocs-addons.js reassigns that whole-array property with a destructive
replace, and when that lands after Cookiebot's network-gated adoption it drops
Cookiebot's sheet, leaving #CybotCookiebotDialog at position:static expanded to
~6700px. It is a race, so it is intermittent and clears once consent is given
(the dialog then never renders).
- layout.html: a small adoptedStyleSheets shim, installed before any page
script, that preserves Cookiebot's sheet so another library cannot drop it.
- custom.css: a leak-safe safety net that keeps the dialog contained even if
its adopted sheet is ever absent. It uses only properties Cookiebot itself
sets, so it has verifiably no effect on the normal, styled banner.
🤖 Generated by [robots](https://vyos.io)
(cherry picked from commit dce7bb521e3947af59fe18895b609ec353e0450e)
Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
|
|
|
|
|
|
(…" (#2095)
This reverts commit 6b88b233b56e7231fbdf0ed4644f741cf634b9ba.
|
|
* docs: Update RPKI page to VyOS 1.5 standards
* Update rpki.md
* Update rpki.md
(cherry picked from commit 5d631ab0628d6b3266b14a7d25ad9e7b66035636)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update Traffic Engineering page to VyOS 1.5 standards
* Update traffic-engineering.md
* Update traffic-engineering.md
(cherry picked from commit 361ea4841449956af979eb24a0b4e2f869d6ebf2)
# Conflicts:
# docs/configuration/protocols/traffic-engineering.md
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update Segment Routing page to VyOS 1.5 standards
* docs: Minor corrections
* docs: Minor formatting corrections
* Update segment-routing.md
(cherry picked from commit f01638d2e6ac85b0096a0895635c325569a7771a)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update RIP page to VyOS 1.5 standards
* Update rip.md
(cherry picked from commit b8a4d737a86015606a1faf0ab49b631db02448b2)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update MPLS page to VyOS 1.5 standards
* Update mpls.md
(cherry picked from commit b02ee21632e7097bc1408388bdfd99f84f8e7771)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
(cherry picked from commit 875b0825b24c03b9a5ba904f8f2d2de946564b74)
Co-authored-by: Nataliia Solomko <natalirs1985@gmail.com>
|
|
high-availability: T7059: Add persistence-timeout option in virtual-server (backport #2053)
|
|
bgp: T8607: Add CLI support for BGP update-delay and establish-wait (backport #1891)
|
|
- Display per-flow packet and byte counters (original and reply
direction).
- Add VRF filter option `show conntrack table <ipv4|ipv6> vrf <vrf-name>`.
(cherry picked from commit 447b0bd6e804896506d3eb65f01856f82c8b9af7)
|
|
* bgp: T8607: Add CLI support for BGP update-delay and establish-wait
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* T8607: Apply Copilot's suggestions
---------
Co-authored-by: Christian Breunig <christian@breunig.cc>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit 65a5a35942c099f337ef4224251bbbaf8e076dbb)
|
|
(cherry picked from commit dc04c30291806195311e585450b490d0c672c356)
|
|
doc-lint regression on [vyos-documentation#2024](https://github.com/vyos/vyos-documentation/pull/2024): the CI workflow's
`scripts/doc-linter.py` scans every line of every changed file
(not just changed lines), so the typo fix on `cli.md:464` and the
capitalization fix on `aws.md:118` surfaced 57 pre-existing >80-char
violations that have lived on rolling since the MyST migration.
`cli.md` — 53 prose paragraphs hard-wrapped at word boundaries to
80 chars, preserving content fidelity. List items use hanging-indent
continuations under their `- ` marker. No content reworded; only
soft-wrap → hard-wrap.
`aws.md` — wrapped the inline AWS GWLB blog link (L164) and the
References section (L185-187) with `% stop_vyoslinter` /
`% start_vyoslinter` markers. These are URL-bearing lines that
cannot be shortened (URL itself >80 chars).
Verified locally:
`python3 scripts/doc-linter.py "['docs/cli.md','docs/installation/cloud/aws.md','docs/automation/terraform/terraformvyos.md']"`
→ exit 0, no violations.
🤖 Generated by [robots](https://vyos.io)
|
|
The full HashiCorp install-CLI URL is 79 chars, so any reference
definition `[X]: <URL>` form exceeds the 80-char docs-lint limit
regardless of label length. Existing `% stop_vyoslinter` /
`% start_vyoslinter` markers in this file were back-to-back with
no content between them (flagged by Copilot on
[vyos-documentation#2021](https://github.com/vyos/vyos-documentation/pull/2021)) — put them to work by wrapping the long
`[install Terraform]:` reference. The shorter
`[Terraform introduction]:` reference (73 chars) sits outside the
suppression range.
Both Copilot and CodeRabbit flagged the docs-lint regression on
[vyos-documentation#2024](https://github.com/vyos/vyos-documentation/pull/2024) — verified locally with
`python3 scripts/doc-linter.py docs/automation/terraform/terraformvyos.md`:
no warnings.
🤖 Generated by [robots](https://vyos.io)
|
|
Surfaced by CodeRabbit on the circinus RST→MD conversion PR
[vyos-documentation#2021](https://github.com/vyos/vyos-documentation/pull/2021) (`terraformvyos.md:14`). Both labels violate MD059
(descriptive link text) — generic words like "link" don't convey
the destination to screen-reader users or search indexers.
Pre-existing on rolling; out of scope for the conversion port,
fixed here at the source. Mergify will backport to circinus and
sagitta. Sibling `automation/terraform/index.md` already uses the
descriptive form ([Terraform], [Ansible]).
🤖 Generated by [robots](https://vyos.io)
|
|
Three pre-existing rolling docs bugs, surfaced by Copilot review on
the sagitta RST→MD conversion PR #2022 against the byte-for-byte
ports of `cli.md` and `aws.md`:
- `cli.md` line 464: `set interface ethernet …` is wrong; the CLI
command is `set interfaces ethernet …` (plural). Users copying the
example verbatim would hit "Configuration path is not valid".
- `cli.md` lines 527-528: orphan `:::` / `::::` fence closers after
the `{cfgcmd} save` block. The `(save)=` directive opens at line
503 and closes at line 506; the two `` ``` none `` blocks at
508-526 are self-contained; nothing opens these colon fences.
MyST/Sphinx tolerates them silently today but they're literal
noise. Drop both.
- `aws.md` line 118: "Cloudwatch" → "CloudWatch", matching the
surrounding correctly-cased uses on lines 115/121/122 and AWS's
product naming.
Mergify will backport to circinus and sagitta via the standard
`@Mergifyio backport circinus sagitta` post-merge.
🤖 Generated by [robots](https://vyos.io)
|
|
docs(circinus): finish RST→MD conversion — drop changelog, port terraformvyos
|
|
The original RST `_include/need_improvement.txt` wrapped the admonition
in `.. raw:: latex \iffalse / \fi`, intentionally hiding the
"Call for Contributions" notice from the LaTeX/PDF builder (see
b222a313, 2020). `.readthedocs.yml` enables `formats: - pdf` and
`conf.py` configures `latex_elements`/`latex_documents`, so PDF output
is a real downstream artifact.
The previous commit (82a06e1d) dropped that suppression. Restore it
using Sphinx's `only` directive with `not latex`, which is the MyST
equivalent of the original RST builder-conditional pattern.
Spotted by Copilot inline review on #2016.
🤖 Generated by [robots](https://vyos.io)
(cherry picked from commit 86de2de975cf4958c84d73cdd669be525e4680ea)
|
|
renders correctly
After the RST→MyST migration, ~45 MD pages use the plain `{include}` MyST
directive to pull in `_include/need_improvement.txt`. The included file
still contained RST (`.. raw:: html`, `.. raw:: latex`, `:ref:`), and
MyST's built-in `{include}` parses the content with the *outer* file's
parser — i.e. as MyST. RST directives then render as literal paragraphs.
Visible symptom on docs.vyos.io/en/rolling (and across 1.5/1.4):
the VPP index, VPP subpages, haproxy, isis, bfd, policy, pki, salt,
flowtables, webproxy, and others all show:
.. raw:: latex
\iffalse
.. raw:: html
Call for Contributions
Help improve this section ...
For contribution guidelines, see :ref: documentation .
Fix: rewrite `_include/need_improvement.txt` as a native MyST admonition
(`:::{admonition} Call for Contributions / :class: error / ... / :::`)
and drop the now-unnecessary `{eval-rst}` wrapper at the single callsite
(`configuration/highavailability/index.md`) that wrapped the include for
RST processing.
The fix is companion to 9c815d68 (cmdincludemd RST plumbing) but targets
the plain-`{include}` path which doesn't route through our custom
extension.
🤖 Generated by [robots](https://vyos.io)
(cherry picked from commit 82a06e1dc812ceba239aaabf4acd651a038bfee7)
|
|
Remove docs/changelog/*.rst (per-version release notes no longer
maintained in-tree on rolling — the changelog dir was already
dropped there). The standalone docs/_ext/releasenotes.py generator
script's filename refs are output paths for manual regeneration,
not Sphinx build inputs, so they remain unchanged in parallel with
rolling.
Port docs/automation/terraform/terraformvyos.md from rolling and
remove the lingering terraformvyos.rst. This was the only remaining
live RST file outside the archive on circinus.
🤖 Generated by [robots](https://vyos.io)
|
|
directives render
The `_include/*.txt` library is written in reStructuredText (`.. cfgcmd::`,
`.. code-block::`, `.. note::`, `.. cmdinclude::`). After the RST→MyST
migration, the `{cmdincludemd}` fence on .md pages routed include content
through `MockState.nested_parse`, which in MyST 2.0 simply replays the
content through the MyST renderer (see myst_parser/mocking.py:153). RST
directives in the .txt file then rendered as literal paragraph text:
<p>.. cmdinclude:: /_include/interface-description.txt</p>
<p>.. cfgcmd:: set interfaces ethernet ...</p>
<p>.. code-block:: none</p>
User-visible symptom (reported on rolling docs): the Ethernet, dummy,
tunnel, bonding, bridge, macsec, vxlan, l2tpv3, pseudo-ethernet,
virtual-ethernet, and wireless pages all showed unprocessed `.. cfgcmd::`
and `.. cmdinclude::` directives instead of styled command boxes.
Fix: mirror MyST's own `{eval-rst}` plumbing
(`MockRSTParser().parse(text, doc)` per
`mdit_to_docutils/base.py:1655`). Build a fresh document that inherits
the outer document's settings + reporter, run `MockRSTParser` over the
substituted include content, and graft the resulting children back
into the calling document with explicit-target registration. Keeps the
Sphinx env available to `cfgcmd`/`opcmd`/`cmdinclude` directives.
Verified locally on rolling (Sphinx 7.x, myst-parser 2.0): zero literal
`cfgcmd::` / `cmdinclude::` / `code-block::` / `opcmd::` / `note::` /
`include::` strings remain in any built HTML page under
`configuration/`, `automation/`, `installation/`, `operation/`,
`vpp/`; all 11 affected interface pages now render proper
`cfgcmd-heading` / `cfgcmd-body` blocks (e.g. ethernet.html: 160,
wireless.html: 172, dummy.html: 4).
🤖 Generated by [robots](https://vyos.io)
(cherry picked from commit 9c815d689a2a4a5d433ba15154cb606bd986fc8d)
|
|
The auto-backport PR #1999 committed literal git conflict markers into
docs/conf.py because _copy_md_sources sits before _write_llms_txt on
circinus but after it on rolling — cherry-pick failed to locate the
patch context and dropped the entire new function as a duplicate with
markers.
Removes the conflict-marker block and applies the actual 3-line guard
to the existing _copy_md_sources function. Build was failing with
"SyntaxError: invalid syntax (conf.py, line 309)".
🤖 Generated by [robots](https://vyos.io)
|
|
(cherry picked from commit ec6f33f3c256e839b443bb2baac14bff32132811)
# Conflicts:
# docs/conf.py
|
|
The md- prefix on MyST-migrated pages was retired; the ignore was dead
config. Replace with _rst_legacy/ so sphinx-autobuild watches don't
trigger on archive edits. Addresses Copilot's low-confidence suggestion
on PR #1940.
🤖 Generated by [robots](https://vyos.io)
|
|
The swap mechanism (RST-as-fallback for migrated MD pages) is dormant —
docs/_rst_overrides.txt has been empty since the MyST flip trio
(#1899/#1900/#1901) landed. The mechanism's surface area is dead weight
and the rst-*.rst shadows scattered across the source tree cause
Context7's parser to misclassify the project as RST.
Sibling PR on rolling: yuriy/remove-rst-swap-mechanism
Changes:
- Move 253 rst-*.rst shadow files into docs/_rst_legacy/ preserving
subdirectory structure. They remain in the repo for reference; Sphinx
excludes the folder via exclude_patterns.
- Strip swap_sources.py invocation from docs/Makefile.
- Strip jobs: pre_build/post_build block from .readthedocs.yml.
- Strip rst-*.rst exclude entry and the _md_exclude.txt loader from
docs/conf.py; replace with a single _rst_legacy exclude.
- Delete scripts/swap_sources.py, tests/test_swap_sources.py,
docs/_rst_overrides.txt.
- Update AGENTS.md: drop the "RST override mechanism" section and the
test-runner snippet for the deleted test.
Verified: sphinx-build -b html with --keep-going produces identical
warning set (68 unique), identical sitemap entry count (267), identical
llms.txt entry count (22), zero rst-* URLs in any artifact.
🤖 Generated by [robots](https://vyos.io)
|
|
(cherry picked from commit 7ae07ade76ec4bb1137553a055419e3955f30618)
|
|
🤖 Generated by [robots](https://vyos.io)
|
|
Read COOKIEBOT_ID from the environment via conf.py html_context,
replacing the hardcoded data-cbid value in layout.html.
Guards tightened to {% if gtm_id and cookiebot_id %} so neither
GTM nor Cookiebot loads unless both IDs are present.
🤖 Generated by [robots](https://vyos.io)
|
