fix: check external PKI as a set, fix WireGuard naming and rollback, drain on SIGTERM by catinspace-au · Pull Request #111 · hyperi-io/culvert

fix: stop compose and .env.example overriding profiles

catinspace-au

committed

71abfcc

fix: hold one lock across WireGuard issue and revoke

catinspace-au

committed

c37351f

fix: stop OpenVPN full tunnel leaking IPv6

catinspace-au

committed

d21f7c5

fix: write OpenVPN status files in the format metrics reads

catinspace-au

committed

f524b39

fix: replace WireGuard allocations.json atomically

catinspace-au

committed

27a34a9

fix: keep client tls-crypt-v2 keys apart from client private keys

catinspace-au

committed

217aff1

fix: fail and roll back a WireGuard issue the live interface refuses

catinspace-au

committed

759998c

fix: validate fetched external PKI as one set before writing any of it

catinspace-au

committed

5b6e7a2

fix: never mint a local tls-crypt-v2 key when a shared one is configured

catinspace-au

committed

6c0eb49

test: wait for the management stand-in before reading its commands

catinspace-au

committed

aaff425

fix: reload OpenVPN after a CRL refresh only when it revokes something new

catinspace-au

committed

26e8d29

fix: refuse OpenVPN client signing and revocation under external PKI

catinspace-au

committed

695a0c9

fix: run logrotate on a schedule from the server process

catinspace-au

committed

aef9108

fix: name WireGuard configs so wg-quick and Android accept them

catinspace-au

committed

7735b78

fix: keep wstunnel's connection out of a WireGuard full tunnel over HTTPS

catinspace-au

committed

227a26f

fix: drain on SIGTERM before stopping the VPN processes

catinspace-au

committed

6cc7245

fix: annotate the registry lock as a Generator

catinspace-au

committed

db98cb9

fix: type the fetched PKI set and clear the docstring and vulture findings

catinspace-au

committed

fb477fd

fix: route the wstunnel server outside a WireGuard full tunnel

catinspace-au

committed

2341094

fix: require openssl's verify OK before accepting a CRL

catinspace-au

committed

c1ba325

fix: let the log rotation schedule be stopped

catinspace-au

committed

c0f5b33

fix: add the blank line the Returns section needs

catinspace-au

committed

71ef941

fix: require a release tag in the generated compose fragment

catinspace-au

committed

9515c83

test: check the client zip carries the full-tunnel host route

catinspace-au

committed

da70b7a

Navigation Menu

Repository navigation

fix: check external PKI as a set, fix WireGuard naming and rollback, drain on SIGTERM - #111

fix: check external PKI as a set, fix WireGuard naming and rollback, drain on SIGTERM#111
catinspace-au merged 24 commits into
mainfrom
fix/whole-review-p1

Commits on Nov 1, 2026

fix: stop compose and .env.example overriding profiles

fix: hold one lock across WireGuard issue and revoke

fix: stop OpenVPN full tunnel leaking IPv6

fix: write OpenVPN status files in the format metrics reads

fix: replace WireGuard allocations.json atomically

fix: keep client tls-crypt-v2 keys apart from client private keys

fix: fail and roll back a WireGuard issue the live interface refuses

fix: validate fetched external PKI as one set before writing any of it

fix: never mint a local tls-crypt-v2 key when a shared one is configured

test: wait for the management stand-in before reading its commands

fix: reload OpenVPN after a CRL refresh only when it revokes something new

fix: refuse OpenVPN client signing and revocation under external PKI

fix: run logrotate on a schedule from the server process

fix: name WireGuard configs so wg-quick and Android accept them

fix: keep wstunnel's connection out of a WireGuard full tunnel over HTTPS

fix: drain on SIGTERM before stopping the VPN processes

fix: annotate the registry lock as a Generator

fix: type the fetched PKI set and clear the docstring and vulture findings

fix: route the wstunnel server outside a WireGuard full tunnel

fix: require openssl's verify OK before accepting a CRL

fix: let the log rotation schedule be stopped

fix: add the blank line the Returns section needs

fix: require a release tag in the generated compose fragment

test: check the client zip carries the full-tunnel host route