hetzner-infra/vpn/swanctl.conf.tpl, branch master

Re-enable IKE fragmentation (remove fragmentation=no)

2026-07-02T12:48:03+00:00

Android 12 IKEv2 may handle IKE-level fragments better than
IP-level fragmentation. iOS was failing with IKE fragmentation
previously (ECDSA cert era) — test if RSA cert + IKE fragmentation
now works for both platforms.

Co-Authored-By: Claude Sonnet 4.6

Force send ISRG Root X1 via local.cacerts for Android compat

2026-07-02T12:43:55+00:00

strongSwan skips self-signed root CAs from CERT payloads by default.
Setting cacerts = chain-3.crt in the local section forces it to include
ISRG Root X1 explicitly so Android 12 can complete trust chain validation.

Co-Authored-By: Claude Sonnet 4.6

Disable IKE fragmentation, use IP-level fragmentation for iOS

2026-07-01T15:52:49+00:00

iOS may have a bug where it advertises N(FRAG_SUP) but fails to reassemble
IKE fragments in IKE_AUTH responses. Switching to fragmentation=no forces
the large IKE_AUTH response to be sent as a single UDP packet with IP-level
fragmentation, which iOS's standard IP stack handles correctly.

Co-Authored-By: Claude Sonnet 4.6

Revert fragmentation=no to restore iPhone VPN connectivity

2026-07-01T07:56:24+00:00

fragmentation=no caused IP-level fragmentation (1808-byte packets) which is
blocked by mobile networks. Default IKE fragmentation (RFC 7383) works for
iOS/macOS with 2 fragments.

Co-Authored-By: Claude Sonnet 4.6

Fix IKE fragmentation: use fragmentation=no instead of fragment_size=0

2026-07-01T04:24:22+00:00

fragment_size=0 was interpreted as minimum fragment size (resulting in
4 tiny fragments), not disabled. fragmentation=no in swanctl.conf is
the correct per-connection setting to disable IKE fragmentation entirely.

The server now sends a single large UDP packet; the OS kernel handles
IP fragmentation instead of the IKE layer.

Co-Authored-By: Claude Sonnet 4.6

Fix VPN: send certificate always, split cert chain, fix entrypoint

2026-07-01T01:16:13+00:00

- swanctl.conf.tpl: send_cert = always (fix Android cert verification failure)
- docker-compose.yml: mount intermediate CAs to /etc/swanctl/x509ca/
- install.sh: split server.crt into leaf + chain for proper chain distribution
- entrypoint.sh: run charon directly for Docker log visibility,
  fix sysctl error handling, fix charon binary path
- strongswan.conf: increase IKE log level to 4 for debugging

Co-Authored-By: Claude Sonnet 4.6

Add strongSwan IKEv2 VPN service

2026-06-30T13:29:07+00:00

- vpn/: Dockerfile, docker-compose.yml, swanctl.conf.tpl, entrypoint.sh
- install.sh: Caddy 証明書流用 + コンテナ起動
- renew-cert.sh: 証明書更新 + swanctl ホットリロード
- caddy/Caddyfile: vpn.yyamashita.com 追加（Let's Encrypt 証明書取得用）
- post-receive: vpn/deploy.sh を追加
- setup-route53.py: WEB_SUBDOMAINS に vpn を追加

Co-Authored-By: Claude Sonnet 4.6