hetzner-infra/vpn, branch master

cgit / vpn のベースイメージを alpine 3.24 に更新

2026-11-07T02:51:47Z

3.19 は EOL、3.21 は 2026-11 で EOL のため。 Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01N5eS3Vkiw8H9jTdKzsF41o

hetzner-admin: stop/start individual services, shown as STOPPED on status page

2026-10-31T13:45:58Z

- run-command.sh: services / stop / start for app and infra stacks (not caddy, hetzner-admin, status). Stopped names go to status/stopped.txt (gitignored). - status: a stopped service that does not respond is STOPPED (gray), excluded from uptime and DOWN alerts. If it responds it is UP as usual. - Infra deploy.sh skips stopped stacks; app repo pushes clear the flag. - claude-code@.service: Restart=on-failure, and restart-sessions.sh restarts one unit at a time, to avoid the tmux "server exited unexpectedly" race. Co-Authored-By: Claude Opus 5.5 Claude-Session: https://claude.ai/code/session_01N5eS3U54gzjRXzm65Np1RS

Re-enable IKE fragmentation (remove fragmentation=no)

2026-07-02T12:48:03Z

Android 12 IKEv2 may handle IKE-level fragments better than IP-level fragmentation. iOS was failing with IKE fragmentation previously (ECDSA cert era) — test if RSA cert + IKE fragmentation now works for both platforms. Co-Authored-By: Claude Sonnet 4.6

Force send ISRG Root X1 via local.cacerts for Android compat

2026-07-02T12:43:55Z

strongSwan skips self-signed root CAs from CERT payloads by default. Setting cacerts = chain-3.crt in the local section forces it to include ISRG Root X1 explicitly so Android 12 can complete trust chain validation. Co-Authored-By: Claude Sonnet 4.6

Append issuer root CA to cert chain for Android IKEv2 compat

2026-07-02T12:35:37Z

Android 12 native IKEv2 requires the presented cert chain to include a cert that is directly in the device trust store. Fetch the issuer root CA (ISRG Root X1) via AIA from the last intermediate cert and append it to server-chain.crt so strongSwan sends 4 CERT payloads: Leaf + YR1 + Root YR + ISRG Root X1 (trusted on all Android versions). Co-Authored-By: Claude Sonnet 4.6

Remove cert logic duplication from vpn/install.sh

2026-07-02T04:17:18Z

install.sh and renew-cert.sh had identical cert fetch/split code. install.sh now delegates to renew-cert.sh, which in turn calls deploy.sh. Flow: install.sh → renew-cert.sh → deploy.sh Co-Authored-By: Claude Sonnet 4.6

Unify install.sh pattern: always delegate to deploy.sh

2026-07-02T04:14:11Z

Both hetzner-admin and vpn install.sh were calling docker compose directly instead of going through their own deploy.sh, unlike mail which already followed the correct pattern. Co-Authored-By: Claude Sonnet 4.6

Send full cert chain to fix iOS IKEv2 validation

2026-07-02T01:15:30Z

iOS IKEv2 does not look up intermediates from the system trust store (unlike TLS/HTTPS). Send all 3 certs: YE1 + Root YE + cross-signed ISRG Root X2, so iOS can build the full chain through to ISRG Root X1. Co-Authored-By: Claude Sonnet 4.6

Disable IKE fragmentation, use IP-level fragmentation for iOS

2026-07-01T15:52:49Z

iOS may have a bug where it advertises N(FRAG_SUP) but fails to reassemble IKE fragments in IKE_AUTH responses. Switching to fragmentation=no forces the large IKE_AUTH response to be sent as a single UDP packet with IP-level fragmentation, which iOS's standard IP stack handles correctly. Co-Authored-By: Claude Sonnet 4.6

Send only YE1+RootYE intermediates, skip cross-signed ISRG Root X2

2026-07-01T15:41:24Z

iOS 14+ and Android 11+ have ISRG Root X2 in their trust store. Sending the cross-signed ISRG Root X2 alongside the trusted self-signed version can confuse the cert path-building algorithm. Chain: leaf -> YE1 -> Root YE -> [ISRG Root X2 from trust store] Co-Authored-By: Claude Sonnet 4.6