Skip to content

chore: remove acme fork#1679

Draft
gsanchietti wants to merge 49 commits into
nethsecurity-8.8from
upstream_acme
Draft

chore: remove acme fork#1679
gsanchietti wants to merge 49 commits into
nethsecurity-8.8from
upstream_acme

Conversation

@gsanchietti
Copy link
Copy Markdown
Member

@gsanchietti gsanchietti commented May 15, 2026

Upstream version has been updated

Refs: #1638

Certificate request is failing:

May 15 14:56:46 NethSec hook[13893]: Using CA: https://acme-v02.api.letsencrypt.org/directory
May 15 14:56:46 NethSec hook[13893]: Running pre hook:'/usr/lib/acme/notify prepare'
May 15 14:56:46 NethSec hook[13893]: Standalone mode.
May 15 14:56:46 NethSec hook[13893]: Account key creation OK.
May 15 14:56:46 NethSec hook[13893]: Registering account: https://acme-v02.api.letsencrypt.org/directory
May 15 14:56:47 NethSec hook[13893]: Registered
May 15 14:56:47 NethSec hook[13893]: ACCOUNT_THUMBPRINT='YP4c0upbxpAqFYwxW7KzKMZq1sQ0LYyUS7G3JGHozoU'
May 15 14:56:47 NethSec hook[13893]: Creating domain key
May 15 14:56:47 NethSec hook[13893]: The domain key is here: /etc/acme/acme.gs.nethserver.net/acme.gs.nethserver.net.key
May 15 14:56:47 NethSec hook[13893]: Single domain='acme.gs.nethserver.net'
May 15 14:56:49 NethSec hook[13893]: Getting webroot for domain='acme.gs.nethserver.net'
May 15 14:56:49 NethSec hook[13893]: Verifying: acme.gs.nethserver.net
May 15 14:56:49 NethSec hook[13893]: Standalone mode server
May 15 14:56:51 NethSec hook[13893]: Pending. The CA is processing your order, please wait. (1/30)
May 15 14:56:53 NethSec hook[13893]: Pending. The CA is processing your order, please wait. (2/30)
May 15 14:56:56 NethSec hook[13893]: Pending. The CA is processing your order, please wait. (3/30)
May 15 14:56:58 NethSec hook[13893]: Pending. The CA is processing your order, please wait. (4/30)
May 15 14:57:01 NethSec hook[13893]: acme.gs.nethserver.net: Invalid status. Verification error details: 138.68.70.176: Fetching http://acme.gs.nethserver.net/.well-known/acme-challenge/G-VdzGF3jFCPlQBVNOJ1P1sVVNmGi21x2gUzGf7HmwQ: Timeout during connect (likely firewall problem)
May 15 14:57:01 NethSec hook[13893]: Please add '--debug' or '--log' to see more information.
May 15 14:57:01 NethSec hook[13893]: See: https://github.com/acmesh-official/acme.sh/wiki/How-to-debug-acme.sh
May 15 14:57:01 NethSec acme-acmesh: State moved to /etc/acme/acme.gs.nethserver.net.failed-1778857021

root@NethSec:~# cat /etc/config/acme 

config acme
	option account_email 'no-reply@nethsecurity.org'
	option debug '0'

config cert 'example_wildcard'
	option enabled '0'
	option staging '1'
	list domains 'example.org'
	list domains '*.example.org'
	option validation_method 'dns'
	option dns 'dns_freedns'
	list credentials 'FREEDNS_User="ssladmin@example.org"'
	list credentials 'FREEDNS_Password="1234"'
	option calias 'example.com'
	option dalias 'dalias.example.com'

config cert 'example_subdomain'
	option enabled '0'
	option staging '1'
	list domains 'example.net'
	list domains 'www.example.net'
	list domains 'mail.example.net'
	option validation_method 'webroot'

config cert 'testacme'
	option enabled '1'
	list domains 'acme.gs.nethserver.net'
	option key_type 'rsa2048'
	option validation_method 'standalone'

Tbaile and others added 19 commits May 15, 2026 13:47
Replace Netdata alerting with vmalert:

- add vmalert init script (vmalert.initd) to start/stop vmalert service
- add vmalert UCI configuration file (vmalert.conf) with datasource settings
- add comprehensive alert rules
- update Makefile to install vmalert configuration and rules
- add detailed documentation of vmalert setup and metrics mapping
- support for Mimir integration when configured via ns-plug
- add ns-plug-alert-proxy that listens on 127.0.0.1:9095 and receives notifications
  from vmalert: the proxy verify if an alert is firing or resolved
  Then it translates selected alerts to the legacy portal format and forwards
  them to my.nethesis.it or my.nethserver.com
- if Mimir credentials are present in ns-plug UCI config, the Mimir
  alertmanager endpoint is added as a second notifier alongside the proxy
- port to Victoria Metrics also alert about non-encrypted backup
- add telegraf-mwan Python script that reads /var/run/mwan3/iface_state/
  to collect WAN interface connectivity state.
- add telegraf-services Python script that queries ubus to collect the
  running state of all procd-managed services. Outputs JSON for

Assisted-by: Copilot:Sonnet4.6
Changes:
- migrate ping monitoring from netdata's fping plugin to telegraf's native
  ping input plugin
- expose metrics to the UI

The ping plugin uses native method (method="native") which sends ICMP
packets directly without external ping command, requiring CAP_NET_RAW
capability or root privileges. Metrics are tagged with
influxdb_db="ping-metrics" for proper InfluxDB database routing.

Assited-by: Copilot:Sonnet4.6
These plugins are required to replace all Netdata features
Netdata has been replaced by Victoria Metrics.
Sync the local adblock fork to upstream 4.5.5-3 while keeping the
NethSecurity-specific ts-dns hooks, bypass migration, and nft bypass
rules intact.

Assisted-by: Copilot:gpt-5.4
Changes:
- add a new `nft-reload` action inside adbblock.sh
- trigger reload when the configuration has been updated
- call nft-reload on reload

The above changes will recreated the nft chain
when the bypass configuration has been changed.
Store Threat Shield DNS local allow and block list edits in UCI
so rapid API calls no longer rewrite adblock files or restart the
service immediately.

Write the physical adblock list files during the next reload, add a
one-shot migration for existing list files, and document the staged
workflow for the affected API methods.

Refs #1572
Assisted-by: Copilot:gpt-5.4
The init file from upstream replaces the dpd_action option values.
Notably it replaces `restart` with `start`, but `start` value
is not supported by Strongswan 6.
Make sure if `restart` is set, the value is preserved.

From the manual:

  Action to perform for this CHILD_SA on DPD timeout. The default clear closes the CHILD_SA
  and does not take further action. trap installs a trap policy, which will catch matching traffic
  and tries to re-negotiate the tunnel on-demand (note that this is redundant if start_action includes trap.
  restart immediately tries to re-negotiate the CHILD_SA under a fresh IKE_SA.
Upstream version has been updated
@gsanchietti gsanchietti mentioned this pull request May 15, 2026
35 tasks
@Tbaile Tbaile force-pushed the nethsecurity-8.8 branch 2 times, most recently from 4001fc2 to 841b872 Compare May 20, 2026 07:12
@gsanchietti gsanchietti self-assigned this May 20, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants