| Age | Commit message (Collapse) | Author |
|---|
|
resolved) (#2253)
* docs: Update BGP page to VyOS 1.5 standards (#2111)
* docs: Update BGP page to VyOS 1.5 standards
* Update bgp.md
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply suggestions from code review
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
* Update bgp.md
* Fix a few factual issues and improve the wording
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply style suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Re-added the closing ``` at line 2289 that the CI bot flagged. No content change
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
(cherry picked from commit 57c7a5adc05186529c3bccf1561a5da7254ed5a4)
# Conflicts:
# docs/configuration/protocols/bgp.md
* docs: Update BGP page to VyOS 1.5 standards (#2111)
* docs: Update BGP page to VyOS 1.5 standards
* Update bgp.md
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply suggestions from code review
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
* Update bgp.md
* Fix a few factual issues and improve the wording
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply style suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Re-added the closing ``` at line 2289 that the CI bot flagged. No content change
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Update bgp.md
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
This reverts commit cb7c5027579041ac3a142fe995d3cd3ccac15a6d.
|
|
* docs: Update BGP page to VyOS 1.5 standards
* Update bgp.md
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Apply suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply suggestions from code review
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
* Update bgp.md
* Fix a few factual issues and improve the wording
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Apply style suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Re-added the closing ``` at line 2289 that the CI bot flagged. No content change
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
(cherry picked from commit 57c7a5adc05186529c3bccf1561a5da7254ed5a4)
# Conflicts:
# docs/configuration/protocols/bgp.md
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* ci: port Cloudflare Workers docs pipeline files to circinus (verbatim)
Copies the branch-agnostic half of the docs.vyos.io Cloudflare Workers
pipeline from `rolling` at 8cb568bf, byte-identical:
- .github/workflows/docs-build.yml
- workers/ (entire tree)
- scripts/docs_gates/
- docker/im-convert.sh
- docs/_static/js/version-picker.js, js/pagefind-wrapper.js,
css/version-picker.css (new files, no circinus counterpart)
- docs/_templates/breadcrumbs.html, searchbox.html (new files)
docs-build.yml already triggers on push to [rolling, circinus, sagitta]
and resolves `circinus` -> worker vyos-docs-v15-en / slug 1.5 from
workers/matrix.json; the files simply did not exist on this branch, so
slug 1.5 still serves the bootstrap placeholder.
workers/versions.json + workers/matrix.json are deliberately identical
across all three branches and must be kept in sync.
Advances: IS-572
* ci: wire circinus docs build into the Cloudflare Workers pipeline
Hand-merges the CF-specific hunks onto circinus's own docker/Dockerfile
and docs/conf.py rather than clobbering them with rolling's versions ā
circinus keeps its own content-driven history in both files.
docker/Dockerfile:
- imagemagick + librsvg2-bin (sphinx.ext.imgconverter backend) and
poppler-utils (pdfinfo, used by docs-build.yml's PDF page-count
completeness check), installed --no-install-recommends
- install docker/im-convert.sh as /usr/local/bin/im-convert
docs/conf.py:
- enable sphinx.ext.imgconverter + image_converter = 'im-convert' so
the LaTeX/PDF builder stops silently dropping .webp/.svg images
- register js/version-picker.js + css/version-picker.css
unconditionally (degrades silently on ReadTheDocs)
- _vyos_cf_build gate off the raw DOCS_VERSION_SLUG env var; only CF
builds load js/pagefind-wrapper.js, and html_context['vyos_cf_build']
lets _templates/searchbox.html fall back to the stock Sphinx
searchbox via the "!" bang-include on RTD
The RTD path stays the default in both files: circinus continues
building on ReadTheDocs until RTD sunset, and every CF feature activates
only when DOCS_VERSION_SLUG is present. .readthedocs.yml is untouched.
circinus keeps its own version/release/html_title/source_suffix and its
hardcoded html_baseurl (its CF slug is also `1.5`, so rolling's
DOCS_VERSION_SLUG/READTHEDOCS_VERSION resolution block is a no-op here
and was deliberately not ported).
Advances: IS-572
* ci: IS-572: re-sync ported Cloudflare Workers pipeline files with rolling
The category-1 files in this port are byte-identical copies from `rolling`.
`rolling` has since moved: [vyos-documentation#2209](https://github.com/vyos/vyos-documentation/pull/2209)
merged as `3a1c6c30`, thirteen rounds of hardening on exactly these files.
Re-take all 14 category-1 paths from `origin/rolling` via
`git checkout origin/rolling -- <paths>`, so byte-identity holds by
construction rather than by hand-editing:
.github/workflows/docs-build.yml
scripts/docs_gates/{gates,parity,smoke,test_gates,test_parity,test_smoke}.py
workers/.gitignore
workers/apex/src/{index,special,uagate}.ts
workers/apex/test/{router,uagate}.test.ts
workers/apex/ua-policy.json
Thirteen of the fourteen carry
[vyos-documentation#2209](https://github.com/vyos/vyos-documentation/pull/2209)
exactly ā the pre-change tree was byte-identical to `3a1c6c30^` for those
paths. `workers/.gitignore` additionally picks up the one-line `test-results/`
entry from
[vyos-documentation#2212](https://github.com/vyos/vyos-documentation/pull/2212);
inert on circinus, since only the deliberately-unported `apex-deploy.yml`
writes that directory.
Deliberate exclusions are unchanged: `docs-canary-qa.yml` (cron runs on the
default branch only, so it is not ported even though
[vyos-documentation#2209](https://github.com/vyos/vyos-documentation/pull/2209)
touched it on `rolling`), `apex-deploy.yml`, and the `docs-preview-*`
workflows. `docs/conf.py` stays hand-merged and circinus-specific, with its
ReadTheDocs fallback intact.
š¤ Generated by [robots](https://vyos.io)
|
|
reboot (#2233) (#2249)
* docs: vpp: document that kernel prerequisites need their own commit and reboot
VPP depends on hugepages and, since T8460, on isolated CPUs. Both are
configured under "system option kernel", take effect only after a
reboot, and are validated by VPP against the running kernel. Because
"vpp" is committed at priority 295 and "system option" at 9999, the two
can never be applied in the same commit - the VPP part is always
rejected with "Not enough free memory to start VPP!" or "Not enough
isolated CPU cores available", both of which point back at the very
command the user just issued.
This is independent of the NIC: the checks that fail take no interface
or PCI information and run before the NIC validation. It was reproduced
both with an unsupported NIC and with a validated one.
Such a commit is also partial: the "system option kernel" part is
applied even though the commit is reported as failed, while the
"set vpp ..." statements are discarded and have to be re-entered after
the reboot.
The "Optimal Configuration Example" showed exactly this failing
one-shot form, mixing "set system option kernel ..." and "set vpp
settings ..." in a single block. Split it into the two stages that
actually work and state why, and add hugepages to it so the example
covers every prerequisite.
Also:
* add a short "Kernel Configuration" item to the requirements page,
which is what a first-time user reads and which had no pointer to
the kernel settings at all
* document the isolated-CPU requirement on the cpu-cores page, which
did not mention "isolate-cpus"
* add the missing 1af4:1041 (virtio modern ID) row to the validated
NIC table - it is present in SUPPORTED_PCI_IDS but was absent here
* correct the allow-unsupported-nics note, which said the check is
bypassed "for the specified devices". There are no specified
devices: _is_device_allowed() returns True for every interface as
soon as the option is set, including interfaces attached later.
That wording is a leftover from the per-PCI-ID form originally
proposed in T8315, which was merged as a single boolean.
Verified by building the docs; the three changed pages produce no
Sphinx warnings.
Claude-Session: https://claude.ai/code/session_01EQsKVSw5hhDu7jPq1YzQvj
* docs: vpp: correct what a failed VPP commit leaves behind
Two corrections to the pages added earlier in this PR.
The partial-commit note claimed that the "set vpp ..." statements are
"discarded". They are not. Verified on VyOS 2026.03: after the commit
fails, "compare" still shows them staged in the configuration session.
[vpp settings]
+ resource-allocation {
+ memory {
+ main-heap-size "6G"
+ }
+ }
What actually happens is worse than the previous wording suggested and
worth stating precisely: the statements are neither applied nor written
by "save", because "save" writes the running configuration - which
"system_option.py" has already updated with the kernel options while the
VPP part was rejected. The session does not survive the reboot, so the
VPP statements are lost there rather than at commit time.
The isolated-CPU requirement was also described as if it only applied
once "cpu-cores" is raised. It applies at the default of "cpu-cores 1"
as well: verify_vpp_cpu_cores() rejects the commit whenever fewer CPUs
are isolated than requested, and VPP takes its main core from the
isolated set. The project's own test_01_vpp_basic relies on this - it
never sets "cpu-cores" and still expects "main-core" to be taken from
/sys/devices/system/cpu/isolated. Without this, a reader doing a minimal
setup would conclude that CPU isolation is optional for them.
Claude-Session: https://claude.ai/code/session_016gXeKHVBq2N8qRAMQkrdM6
(cherry picked from commit 93f84b050c90cb2d21d5216fc9d54fbcd118f407)
Co-authored-by: ēµå <miagetegorann@gmail.com>
|
|
(cherry picked from commit 7662f4c3684fbc684228e0bda2ef4594f49a0e9a)
|
|
(cherry picked from commit 6c3f55ab592927fdbe67739b33707eac02d2f57e)
|
|
(cherry picked from commit 367585ea4de297f375c30424b78dd9dedab09874)
|
|
(cherry picked from commit 42b8198e4323c89490df80c0058ad890849172bf)
|
|
Introduced the kdump section detailing its purpose and functionalities.
(cherry picked from commit ba9eb9b336f3664c87761e9000b3ef963cb2ce48)
|
|
(cherry picked from commit 9a39835d9096bbdab37c97950ce3010ad2bc1402)
|
|
* docs: Update LLDP page to VyOS 1.5 standards
* Update lldp.md
(cherry picked from commit 3740b225ad388fb608d0397f493a9aaa9efd3b1f)
|
|
* docs: Update IPoE server page to VyOS 1.5 standards
* Minor corrections
* Update ipoe-server.md
(cherry picked from commit 224cc62db7dfe735526b62396861a57ded7d7985)
|
|
(#2135)
* docs:T8598: Add IPv6 peer-IID secret configuration for calling-sid option
* docs: T8598: Fix linter for PPoE, L2TP, PPTP and SSTP documentation
* Clarify that VyOS uses accel-ppp-ng
Co-authored-by: Viacheslav Hletenko <seversss265@gmail.com>
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
Co-authored-by: Viacheslav Hletenko <seversss265@gmail.com>
|
|
docs: clarify Proxmox NoCloud seed ISO attachment
|
|
|
|
|
|
* docs: update flowtable and ethernet/bonding documentation
* Removing Netfilter word and add the identification of the interfaces to use FlowTables
* Fixed warning from commit:c433e15
* Update docs/configuration/firewall/flowtables.md
* Update docs/configuration/firewall/flowtables.md
* Update docs/configuration/firewall/flowtables.md
* Update docs/configuration/firewall/flowtables.md
* cfgmc structure and sub-interface offload fixed
* Fixed conflicts on flowtable documentation
* revert ethernet.md and fixed the latest infos
* added subsection to the checks section to show offloaded traffic for sub-interfaces
* Final changes
* Changed conntrack -L to VyOS command
* Replacing new output description with VyOS command
---------
(cherry picked from commit a0067e0fbc8c3bee2af6701b3542eb013146fcf8)
Co-authored-by: jvela-dot <j.vela@vyos.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
* docs: Update Event handler page to VyOS 1.5 standards (#2130)
* docs: Update Event handler page to VyOS 1.5 standards
* Apply suggestions from code review
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
(cherry picked from commit d08dbfacca29aa1e9750468293dd00910ad775ee)
* Use "event handler" styling in text and remove the mention of netplugd
since it's replaced by vyos-netlinkd in rolling already
Co-authored-by: Daniil Baturin <daniil@baturin.org>
---------
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@vyos.io>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
(#2136) (#2144)
* docs(DMVPN): T4667: Add firewall rule to prevent unencrypted GRE leaks
In DMVPN the mGRE tunnel and the IPSec protecting it are handled
independently, so GRE can be forwarded while no IPSec SA is active for a
peer (e.g. while an SA is still being negotiated or after one expires),
allowing unencrypted GRE to leave the router. This is inherent to
combining GRE with IPSec and is common to DMVPN implementations in
general.
Add a "Protecting against unencrypted traffic leaks" section to the DMVPN
reference page explaining the behaviour and recommending an output filter
rule that drops GRE not matched by an outbound IPSec policy
(ipsec match-none-out). Note that this disables unencrypted GRE on the
node entirely, so coexisting plain GRE tunnels would stop working.
Apply the same rule in the Dual HUB Dual Cloud example on the VyOS nodes.
* docs(DMVPN): reflow DMVPN documentation for line length compliance
Reformat the DMVPN guide and dual-hub dual-cloud example to wrap
long lines and improve readability without changing the documented
behavior or configuration guidance.
---------
(cherry picked from commit 50acf8f188475b0554b99a739cb8ada12d51e77b)
Co-authored-by: zdc <zdc@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
(#2178) (#2180)
(cherry picked from commit 4631db6a1578550dd4c1410a8416575899f36936)
Co-authored-by: John Estabrook <jestabro@vyos.io>
|
|
vyos-api: fill automation API doc gaps (T9087āT9092) (backport #2152)
|
|
(backport #2176) (#2179)
* docs(Installation): Remove outdated portal link and Proxmox/KVM cloud-init note
(Manual backport of Liudmyla's original for rolling)
* Break long lines in install.md to pass the linter check
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
`docs/superpowers/` holds Claude Code plugin-generated internal design
specs and plans, not user documentation. Adding `superpowers` to
`exclude_patterns` guards against Sphinx ever picking the directory up
and publishing it should it reappear in the source tree.
Guard only ā the content itself was already removed in 3ab97e71 and
abb8be5b.
(cherry picked from commit a9dc16aac2a7e7a6e5e4bb1c19897b3d707ba4d1)
Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
|
|
Convert the multi-field-node table to wrapped list items per the 80-char
docs guideline, and rework the bulk-apply bullet to reconcile state
before retrying after a timeout instead of recommending blind retries.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 2510eefadc8e7520e7f85f45a2b29fdab634474a)
|
|
Only port/port-group require protocol in the same request; description
alone is fine on an existing rule but fails on a rule no request has
created yet.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 9e90088827c53f8d61e82e2e29910a9346009e87)
|
|
Batch sizing, geoip/remote-group commit cost, the 1 MB
request-body-size-limit, and commit-confirm as a remote safety net.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit af04731c74b0383bc36c66addd6cc22ba41c55e0)
|
|
Document that an operation list commits as one transaction whose error
may not identify the failing op (bisect / one-op fallback), and that
/configure rejects {"op": "save"} ā persistence goes through
/config-file.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit f002549a5fe3ae782be8fe02160fa2796e7e0471)
|
|
showConfig returns HTTP 400 'Configuration under specified path is
empty' for schema-valid but unconfigured paths; recommend probing with
exists or treating that error as an empty subtree.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 3a952350bf5b5b38a7db1208ed3c910ded7b4b24)
|
|
The /show endpoint can return the running config as flat set commands
(op-mode 'show configuration commands' equivalent) ā the natural way to
mirror or back up a router over the API; previously undocumented.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit ca902d4eebd49697f476d538eadfcaeb8ebb2232)
|
|
Each /configure request is validated and committed on its own, so fields
of one node (task-scheduler executable+interval, NAT translation,
firewall action/protocol before port) must be sent in a single request.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
(cherry picked from commit 0b88b491d043e5f281d8e3ae499c4d045da28f28)
|
|
(cherry picked from commit 9ad380fb7a1b122a605c7562124085e3200e30f0)
Co-authored-by: Christian Breunig <christian@breunig.cc>
|
|
* DOCS: Backport 2117 (Revise Console server page) to Circinus
* Update console-server.md
|
|
* docs: Update TFTP server page to VyOS 1.5 standards
* Update tftp-server.md
(cherry picked from commit 8be9ced92fdc2b12b16aae9e438884acfd387faf)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* configexamples/inter-vrf-routing-vrf-lite: fix formatting
* configexamples/inter-vrf-routing-vrf-lite: reformat text to limit line length
|
|
* docs: Update Config sync page to VyOS 1.5 standards
* Minor corrections
* Update config-sync.md
* Apply suggestion from @github-actions[bot]
* Apply suggestion from @github-actions[bot]
---------
(cherry picked from commit 228149f1a1d824b968b565f82c3ee73eb7ba489c)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
|
|
(#2108) (#2109)
On a fresh (no-consent) load the consent banner could render completely
unstyled and expand to full page height. Cookiebot delivers its dialog CSS as
a constructed stylesheet on document.adoptedStyleSheets; ReadTheDocs'
readthedocs-addons.js reassigns that whole-array property with a destructive
replace, and when that lands after Cookiebot's network-gated adoption it drops
Cookiebot's sheet, leaving #CybotCookiebotDialog at position:static expanded to
~6700px. It is a race, so it is intermittent and clears once consent is given
(the dialog then never renders).
- layout.html: a small adoptedStyleSheets shim, installed before any page
script, that preserves Cookiebot's sheet so another library cannot drop it.
- custom.css: a leak-safe safety net that keeps the dialog contained even if
its adopted sheet is ever absent. It uses only properties Cookiebot itself
sets, so it has verifiably no effect on the normal, styled banner.
š¤ Generated by [robots](https://vyos.io)
(cherry picked from commit dce7bb521e3947af59fe18895b609ec353e0450e)
Co-authored-by: Yuriy Andamasov <yuriy@vyos.io>
|
|
|
|
|
|
(ā¦" (#2095)
This reverts commit 6b88b233b56e7231fbdf0ed4644f741cf634b9ba.
|
|
* docs: Update RPKI page to VyOS 1.5 standards
* Update rpki.md
* Update rpki.md
(cherry picked from commit 5d631ab0628d6b3266b14a7d25ad9e7b66035636)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update Traffic Engineering page to VyOS 1.5 standards
* Update traffic-engineering.md
* Update traffic-engineering.md
(cherry picked from commit 361ea4841449956af979eb24a0b4e2f869d6ebf2)
# Conflicts:
# docs/configuration/protocols/traffic-engineering.md
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update Segment Routing page to VyOS 1.5 standards
* docs: Minor corrections
* docs: Minor formatting corrections
* Update segment-routing.md
(cherry picked from commit f01638d2e6ac85b0096a0895635c325569a7771a)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update RIP page to VyOS 1.5 standards
* Update rip.md
(cherry picked from commit b8a4d737a86015606a1faf0ab49b631db02448b2)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
* docs: Update MPLS page to VyOS 1.5 standards
* Update mpls.md
(cherry picked from commit b02ee21632e7097bc1408388bdfd99f84f8e7771)
Co-authored-by: LiudmylaNad <l.nadolina@vyos.io>
|
|
(cherry picked from commit 875b0825b24c03b9a5ba904f8f2d2de946564b74)
Co-authored-by: Nataliia Solomko <natalirs1985@gmail.com>
|
|
high-availability: T7059: Add persistence-timeout option in virtual-server (backport #2053)
|
|
bgp: T8607: Add CLI support for BGP update-delay and establish-wait (backport #1891)
|
|
- Display per-flow packet and byte counters (original and reply
direction).
- Add VRF filter option `show conntrack table <ipv4|ipv6> vrf <vrf-name>`.
(cherry picked from commit 447b0bd6e804896506d3eb65f01856f82c8b9af7)
|
|
* bgp: T8607: Add CLI support for BGP update-delay and establish-wait
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* T8607: Apply Copilot's suggestions
---------
Co-authored-by: Christian Breunig <christian@breunig.cc>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
(cherry picked from commit 65a5a35942c099f337ef4224251bbbaf8e076dbb)
|
