Add vm.conf with sysctl parameters optimized for embedded network
devices 512MB-8GB of memory.
Focus on fast recovery and determinism.
- Panic on OOM
- Aggressive dirty page writeback
- Increased watermark scale factor for proactive reclaim
Includes tuning guide documentation for alternative scenarios.
Signed-off-by: Richard Alpe <richard@bit42.se>
This commit adds optional support for encrypting the tarball before it
leaves the target system. Documentation and usage text updated.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Validate keys in gen_hostkey() before passing empty keys to shell scripts,
preventing:
Nov 04 2024 10:54:25 confd[2697]: SSH key (genkey) does not exist, generating...
Nov 04 2024 10:54:25 confd[2697]: writing RSA key
Nov 04 2024 10:54:26 confd[2697]: do_convert_from_pkcs8: /tmp/tmp.FH1Hr1 is not a recognised public key format
Also, fix base64 content formatting with proper 64-character line wrapping
using printf+fold instead of echo.
Use PKCS#1 RSA format for public keys as required by netopeer2-server, while
keeping PKCS#8 format for private keys. Use proper ssh-keygen format flag
(PKCS8) for correct conversion.
Fixes#1289
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Let's drop the leading IETF or Infix prefixes from tests. Initially the
idea was to mimnic the YANG models, but it's difficult to navigate and
does not provide any real benefit to developers or end-users.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
We use the infinitive, or basic form, in configure context, as do most
other network vendors, so let's do the same in admin exec context.
Also, drop the 'name' qualifier, it is not needed in configure context
so we shouldn't have to use it in admin exec either.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Adds support for configuring TTL, ToS/DSCP, and Path MTU Discovery
on GRE and VXLAN tunnels. TTL defaults to 64 instead of inherit to
prevent issues with routing protocols like OSPF that use TTL=1.
Refactors tunnel YANG models by merging local-remote into a unified
tunnel-common grouping for cleaner organization.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Many of the example prompts used in the documentation are very long and
do not fit in generated documentation (web/pdf). This is a proposal to
shorten them, sometimes significantly, by keeping only the start and end
of an xpath, replacing everything in between with '/…/'.
This is a feature that also could be added to the klish-plugin-sysrepo
to improve usability.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Neither the IPv6 autonconf container, nor the recently moved DHCP client
container have an 'enabled' flag.
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Please note, this change drops not only the global enabled flag, but also the
per-interface enabled flag, converting it to a presence container. The name
of the container is also shortened from dhcp-client -> dhcp. A pattern that
expected to be reused also for the DHCPv6 client.
Fixes#1109
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Bridge ports should not have IP addresses configured. The IP address
should be configured on the bridge interface itself, not its member ports.
Add YANG must expression to enforce this rule at configuration time.
Fixes#1122
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
A valid DHCP server setup for a subnet is one of pool and/or at least one
static host entry/lease. If pool is enabled the pool must have a start
and an end address.
To allow setting up a DHCP server with no pool and at least one static host
entry/lease, we make the pool a presence container, otherwise the pool will
always be set and trigger the below inference.
When an interactive CLI/Web user enables the address pool we infer a default
range .100-.250, but only for /24, C-class networks. This is what most users
know and expect.
The YANG model now validates that:
- If an address pool is created, both start-address and end-address must be set
- Each subnet must have either a pool or at least one static host entry
- The pool container is now a presence container, so "no pool" fully deletes it
Fixes#1121
Signed-off-by: Joachim Wiberg <troglobit@gmail.com>
Richard Alpe