| Age | Commit message (Collapse) | Author |
|---|
|
Add an Operation section with {opcmd} entries for 'show secure-boot' and 'show
secure-boot detail', and reference it from the installation verification step.
|
|
Note that "encryption data-ciphers-fallback" only takes CBC ciphers
together with "shared-secret-key".
|
|
The two nat64prefix examples use the well-known prefix 64:ff9b::/96,
which the doc linter reports as outside the documentation ranges. Wrap
them in stop/start_vyoslinter markers, as AGENTS.md describes for this
prefix, so the page passes the linter.
|
|
Document the three per-interface options added in vyos-1x for T9413,
which keep radvd from sending zero-lifetime router, RDNSS and DNSSL
advertisements on shutdown, and add an example of two routers sharing
fe80::1 as the RA source address through VRRP.
|
|
openvpn: T9370: document the chacha20poly1305 data cipher
|
|
* container: document remaining per-container options and network types
The container page covered 44 of the 53 nodes in container.xml.in. Add
the eight that were missing, grouped where they belong on the page:
- allow-host-cgroups, next to allow-host-pid
- network <net> mac, next to the network address option
- volume <vol> propagation, with all six modes
- stop-timeout, next to restart
- shared-memory, next to memory
- network <net> type bridge / type macvlan mode / type macvlan parent
The network type is the notable gap: MACVLAN was entirely undocumented,
although it is the way to put containers directly on a parent network
instead of behind the host bridge and NAT. The page now states that
parent and mode are both required, that the parent must exist, and that
MACVLAN networks cannot be assigned to a VRF - all three are enforced
by verify() in src/conf_mode/container.py.
Defaults and ranges are taken from container.xml.in; the "--cgroupns
host" note matches what the quadlet generator emits.
* container: describe volume propagation in terms of mount events
The six propagation modes were described in terms of sub-mount
visibility, taken from the <description> text in container.xml.in. That
is not what the modes do - mount(2)/umount(2) event propagation is.
Per mount_namespaces(7):
- MS_SHARED propagates events *both ways* between members of the peer
group, not only from the original mount to the replica
- MS_PRIVATE propagates no events out of or into the mount; it does not
hide sub-mounts within it
Also note the constraint the host side imposes, which is easy to trip
over: per docker-run(1)/podman, shared propagation requires the source
mount to be shared and slave requires it to be shared or slave, or the
requested mode silently does not take effect. Added the findmnt
invocation to check it.
Raised by CodeRabbit on #2244.
* container: document stop-timeout range and MACVLAN private mode precisely
|
|
* docs: T9200: note no-ipv6-auto-ra doesn't stop already-active RA
no-ipv6-auto-ra only prevents future RA initiation; it doesn't
retroactively silence router advertisements already sent on an
established session. Confirmed on VyOS 1.5.1: neither a soft nor a
hard clear/reset bgp on the neighbor stopped it. Per FRR's
bgp_zebra_terminate_radv()/upstream PR FRRouting/frr#19487, that only
runs when the neighbor's remote-as is removed and re-added.
* docs: T9200: distinguish blast radius of the two RA workarounds
remote-as re-add only affects the one neighbor; a bgpd/frr restart
clears every BGP session on the router. The note listed them as
equivalent options - reframe the restart as a maintenance-window
fallback instead.
Flagged by CodeRabbit review on PR #2195.
* Make the note less wordy
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
Add chacha20poly1305 to "encryption data-ciphers" and
"encryption data-ciphers-fallback".
|
|
Document "interfaces openvpn <interface> mtu", its 1420 bytes default
with DCO and its constraints.
|
|
|
|
* docs: installation: clarify minisign verification for rolling images
* Update install.md
|
|
|
|
Added documentation to correspond to the change to make several agent values configurable instead of hardcoded
|
|
(#2252)
|
|
* docs: Update FRR page to VyOS 1.5 standards
* Minor corrections
* Update frr.md
|
|
|
|
* docs: Update Serial console page to VyOS 1.5 standards
* Remove a passage with outdated information
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
|
|
* docs: vpp: remove netlink and lcp IPsec options
Removed netlink and lcp options from the VPP IPsec documentation
(dataplane/ipsec.md) as they were removed from the CLI.
Also updated the IPsec configuration page (vpp/configuration/ipsec.md):
- Clarified that the IPsec option can be configured in the VPP
configuration section
- Removed the netlink rx-buffer-size and lcp ignore-kernel-routes
options from the configuration example
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* docs: vpp: fix wording and broken anchor after netlink removal
- Restore "VPN configuration section" wording (was accidentally changed
to "VPP configuration section", which contradicts the linked page and
the fact that IPsec tunnels are configured via the ordinary vpn ipsec
tree, not a VPP-specific section).
- Fix broken anchor in the "disable the kernel routes synchronization"
link: lcp.md's real anchor is vpp_config_dataplane_lcp_ignore_kernel_routes,
not vpp-lcp-configuration.
- Remove leftover blank line left after deleting the netlink section.
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* docs: vpp: fix lcp.md link path and wrap long line
- The link target anchor lives in docs/vpp/configuration/dataplane/lcp.md,
not a sibling docs/vpp/configuration/lcp.md, so the relative path needs
the dataplane/ prefix.
- Convert to a shortcut reference link to keep the visible line under the
80-character doc-lint limit; the long URL moves to a reference
definition at the bottom of the file, suppressed with
stop/start_vyoslinter per the documented convention for unavoidably
long lines.
Verified locally with `python3 scripts/doc-linter.py
'["docs/vpp/configuration/ipsec.md"]'` (exit 0, no warnings).
Co-Authored-By: Claude Sonnet 5 <noreply@anthropic.com>
* add ignore-kernel-routes.md
---------
Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>
|
|
* docs: vpp: document missing loopback mac option
* Added correct mac option description loopback.md
|
|
* Cleaned up container document
Added more explicit explanation to some items
Added note on Global State Policies and container networks about
accept-invalid
* Update docs/configuration/container/index.md
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update docs/configuration/container/index.md
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Update docs/configuration/container/index.md
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Update docs/configuration/container/index.md
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
* Added suggested fixes from coderabbit.
* Fixed opmode for Adguard Home
* Fix health-check retry command
* Fixed the adguard example add container image fence and changed the
wording around directories.
* Fixed line exceeds 80 char at volume mount
Fixed fences
* Update docs/configuration/container/index.md
No idea how that ended up in the file.
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
* Fix grammar for Zabbix example
* Remove a third-party service example
---------
Co-authored-by: github-actions[bot] <41898282+github-actions[bot]@users.noreply.github.com>
Co-authored-by: coderabbitai[bot] <136622811+coderabbitai[bot]@users.noreply.github.com>
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: T9175: document dns forwarding options security-poll-suffix
Document the new opt-in `service dns forwarding options
security-poll-suffix` setting that controls the PowerDNS recursor's
periodic security status poll, disabled by default.
* docs: T9175: fix security-poll-suffix placement and clarify disable
The security-poll-suffix cfgcmd was placed under "Per-domain
forwarding" even though it's a global forwarding option, and used the
"forwarding options" convention (bold summary + Example block) used
by ecs-add-for/ecs-ipv4-bits/edns-subnet-allow-list right above it.
Also documents how to disable polling again (delete the option),
clarifies it only takes effect with a non-empty suffix, and that
secpoll.powerdns.com is PowerDNS' own poll domain rather than a VyOS
default. Switches secpoll.powerdns.com from double to single
backticks, matching MyST inline-code convention.
Flagged by CodeRabbit and the Claude review bot on PR #2193.
* docs: T9175: rename security-poll-suffix option to security-status-poll-domain
Follows vyos-1x PR #5389 rename per dmbaturin's review: the value is a
full FQDN, not a suffix, and the poll checks for known vulnerabilities.
|
|
cli: T9077: document literal question mark entry and value quoting
|
|
* docs: T9157: document firewall fib-type match
Companion doc entry for vyos/vyos-1x#5372, which adds
"fib-type" as a source/destination match option
(nftables' fib daddr/saddr type expression) for
forward/input/output/name rule sets, ipv4 and ipv6.
* docs: T9157: update fib match docs for fib-type -> fib type rename
Companion vyos-1x PR #5372 restructured the "fib-type" leaf into a
"fib" node with a "type" child (following feedback from l0crian1 and
sarthurdev to reserve the "fib" namespace for a possible future
lookup/match concatenation feature, tracked separately under T5119).
Update the CLI paths and examples here to match, and fix "prohibited"
to "prohibit" to match nftables' actual fib_addrtype token.
* docs: T9157: add prerouting raw fib type reference, fix backtick style
CodeRabbit feedback on #2186:
- the prose showed a "prerouting raw" example but the command
reference only listed forward/input/output/name filter forms, even
though fib.xml.i is also included from common-rule-ipv{4,6}-raw.xml.i
for that hook. Add the missing source/destination cfgcmd entries.
- MyST pages use single backticks for inline code, not double
(that's for embedded RST); fix the fib type prose accordingly.
* docs: T9157: update fib docs for rule-level lookup/match split
Companion vyos-1x PR #5372 moved "fib" from a leaf nested under
destination/source to a rule-level node with separate "lookup"
(source-address/destination-address) and "match route-type" children,
per l0crian1's review feedback - reserving room for mark/iif/oif
lookup keys and oif/oifname match results later (tracked under T5119)
without ever renaming what ships now. Update the CLI paths and
examples here to match.
|
|
reboot (#2233)
* docs: vpp: document that kernel prerequisites need their own commit and reboot
VPP depends on hugepages and, since T8460, on isolated CPUs. Both are
configured under "system option kernel", take effect only after a
reboot, and are validated by VPP against the running kernel. Because
"vpp" is committed at priority 295 and "system option" at 9999, the two
can never be applied in the same commit - the VPP part is always
rejected with "Not enough free memory to start VPP!" or "Not enough
isolated CPU cores available", both of which point back at the very
command the user just issued.
This is independent of the NIC: the checks that fail take no interface
or PCI information and run before the NIC validation. It was reproduced
both with an unsupported NIC and with a validated one.
Such a commit is also partial: the "system option kernel" part is
applied even though the commit is reported as failed, while the
"set vpp ..." statements are discarded and have to be re-entered after
the reboot.
The "Optimal Configuration Example" showed exactly this failing
one-shot form, mixing "set system option kernel ..." and "set vpp
settings ..." in a single block. Split it into the two stages that
actually work and state why, and add hugepages to it so the example
covers every prerequisite.
Also:
* add a short "Kernel Configuration" item to the requirements page,
which is what a first-time user reads and which had no pointer to
the kernel settings at all
* document the isolated-CPU requirement on the cpu-cores page, which
did not mention "isolate-cpus"
* add the missing 1af4:1041 (virtio modern ID) row to the validated
NIC table - it is present in SUPPORTED_PCI_IDS but was absent here
* correct the allow-unsupported-nics note, which said the check is
bypassed "for the specified devices". There are no specified
devices: _is_device_allowed() returns True for every interface as
soon as the option is set, including interfaces attached later.
That wording is a leftover from the per-PCI-ID form originally
proposed in T8315, which was merged as a single boolean.
Verified by building the docs; the three changed pages produce no
Sphinx warnings.
Claude-Session: https://claude.ai/code/session_01EQsKVSw5hhDu7jPq1YzQvj
* docs: vpp: correct what a failed VPP commit leaves behind
Two corrections to the pages added earlier in this PR.
The partial-commit note claimed that the "set vpp ..." statements are
"discarded". They are not. Verified on VyOS 2026.03: after the commit
fails, "compare" still shows them staged in the configuration session.
[vpp settings]
+ resource-allocation {
+ memory {
+ main-heap-size "6G"
+ }
+ }
What actually happens is worse than the previous wording suggested and
worth stating precisely: the statements are neither applied nor written
by "save", because "save" writes the running configuration - which
"system_option.py" has already updated with the kernel options while the
VPP part was rejected. The session does not survive the reboot, so the
VPP statements are lost there rather than at commit time.
The isolated-CPU requirement was also described as if it only applied
once "cpu-cores" is raised. It applies at the default of "cpu-cores 1"
as well: verify_vpp_cpu_cores() rejects the commit whenever fewer CPUs
are isolated than requested, and VPP takes its main core from the
isolated set. The project's own test_01_vpp_basic relies on this - it
never sets "cpu-cores" and still expects "main-core" to be taken from
/sys/devices/system/cpu/isolated. Without this, a reader doing a minimal
setup would conclude that CPU isolation is optional for them.
Claude-Session: https://claude.ai/code/session_016gXeKHVBq2N8qRAMQkrdM6
|
|
* firewall/groups: document include option and remote-group interval
These CLI nodes existed in the XML definitions but were missing from
the docs entirely, per docs.vyos.io/en/1.5/coverage.html:
- include: lets one group nest another group of the same type
(address-group, ipv6-address-group, network-group,
ipv6-network-group, mac-group, port-group, interface-group)
- remote-group interval: overrides the global resolver-interval on a
per-group basis
* firewall/groups: clarify remote-group interval range applies post-conversion
CodeRabbit review on #2241 noted the range (60-2419200s) wasn't clearly
tied to suffixed values. Confirmed in vyos-1x conf_mode/firewall.py:
human_to_seconds() converts the value first, then the range check
runs on the converted seconds -- so e.g. "30s" is rejected same as "30".
|
|
* docs: T8045: document dont-query
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update sFlow page to VyOS 1.5 standards
|
|
|
|
* docs: Update Conntrack page to VyOS 1.5 standards
* Update conntrack.md
* Apply suggestion from @dmbaturin
* Apply suggestion from @dmbaturin
* Apply suggestion from @dmbaturin
* Apply suggestion from @dmbaturin
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update Acceleration page to VyOS 1.5 standards
* Apply batched suggestions from code review
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Update acceleration.md
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
docs: T9166: document IPv6 for HA peer link
|
|
* firewall: T9076: document remote-group update interval
Document the new 'set firewall group remote-group <name> interval'
command: per-group update interval from 60 seconds to 4 weeks, given
as plain seconds or with s/m/h/d/w suffixes (e.g. 4h), falling back
to the global resolver-interval when unset.
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* firewall: T9076: note URL quoting and log redaction for remote-group
Warn that remote-group URLs with query strings must be quoted (unquoted
'&' silently truncates the value; literal '?' may need Ctrl-V, see
T9077) and that vyos-domain-resolver logs redact the query string on
download failures (T8829).
Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
* firewall: T9076: note that remote-group interval suffixes may be combined
Address review feedback: document that s/m/h/d/w units can be stacked
(e.g. 1h30m), matching human_to_seconds and the CLI regex.
---------
Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
|
|
* docs: Update Monitoring page to VyOS 1.5 standards
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update SNMP page to VyOS 1.5 standards
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update PPPoE server page to VyOS 1.5 standards
* Update pppoe-server.md
* Update pppoe-server.md
* Clarify the meaning of `noauth`
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
* docs: Update NTP page to VyOS 1.5 standards
|
|
* docs: Update Flow accounting page to VyOS 1.5 standards
* Minor corrections
* Minor corrections
* Update flow-accounting.md
* Apply batched suggestions from code review
docs: Applied review suggestions to the Flow accounting page
Co-authored-by: Daniil Baturin <daniil@baturin.org>
* Remove the passage about address family match requirements
---------
Co-authored-by: Daniil Baturin <daniil@baturin.org>
|
|
docs: add Google Cloud HA VPN BGP example
|
|
T5735: Add service stunnel documentation
|
|
Add a new configuration page for the stunnel service.
|
|
|
|
|
|
kdump: T8868: Add documentation for kernel crash dump feature
|
|
|
|
|
|
(#2174)
Co-authored-by: JR Lanteigne <dniminenn@users.noreply.github.com>
|
|
* docs: Update LLDP page to VyOS 1.5 standards
* Update lldp.md
|
|
* docs: Update IPoE server page to VyOS 1.5 standards
* Minor corrections
* Update ipoe-server.md
|
|
* docs: T9159: document service ntp source-address option
Companion doc entry for the vyos-1x change adding
"set service ntp source-address <address>" (chrony's bindacqaddress).
* docs: T9159: document service ntp source-interface option
Companion doc entry for the vyos-1x change adding
"set service ntp source-interface <interface>" (chrony's
bindacqdevice), addressing multi-VRF feedback on T9159.
* docs: T9159: clarify source-interface is scoped to a single VRF
The source-interface description implied it helps disambiguate
across multiple VRFs at once, but service ntp vrf already binds the
whole NTP client to a single VRF - source-interface only picks the
egress device within that one VRF.
Flagged by CodeRabbit review on PR #2185.
|
