debian-edu-router (2.13.5) unstable; urgency=medium

  [ Mike Gabriel ]
  * ChangeLog: update post-upload

  [ Nuri KÜÇÜKLER ]
  * Turkish translations for non devconf messages

 -- Mike Gabriel <sunweaver@debian.org>  Wed, 23 Jul 2025 10:58:15 +0200

debian-edu-router (2.13.4) unstable; urgency=medium

  [ Nuri KÜÇÜKLER ]
  * Turkish translation .po file. (Closes: #1109066).

  [ Paulo Henrique de Lima Santana ]
  * debian/po: Update pt_BR.po. (Closes: #1109100).

  [ Mike Gabriel ]
  * debian/*.lintian-overrides: Glob file lines in overrides for the debconf
    templates file, as they seem to jump around with every build.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 14 Jul 2025 22:37:20 +0200

debian-edu-router (2.13.3) unstable; urgency=medium

  [ Mike Gabriel ]
  * po/: Update German translations
  * debian/d-e-r-p.c-f.postinst:
    + In create_squid_config_sslbumping_rules() fix log config block jumping
      between config snippets when enabling/disabling SSL bumping.
    + In create_squid_config_{sslbumping_rules,icap}() attribute '${_i_n_name}'
      variable with 'local'.
    + Always create 20_ICAP-e2guardian_d-e-r-p.c-f_<internal_network>.conf file
      (even if deep content filtering is disabled).
    + Only configure a network's squid daemon to use e2guardian as ICAP filter
      if SSL bumping is enabled for that network's squid service.
    + Only call create_sslmitm_ca() once and call it if SSL bumping is
      configured _or_ transparent proxying.
    + Rework creation of SSL bumping and/or transparent proxy settings in
      network-specific configuration files.
  * debian/d-e-r-p.c-f.config:
    + Fix comments. E2guardian is not doing SSL-MitM stuff.
  * po/:
    - Update German translations
  * debian/copyright: Update copyright attributions.
  * lintian: Update various line numbers in override files.

  [ Daniel Teichmann ]
  * d-e-r-p.c-f.postinst:
    + Add 'TODO:' comment.
    + Add missing comment at Squid's http{s}_port directive for transparent
      proxy mode.

  [ Serhii Horichenko ]
  * .gitignore:
    - Add ignore for *~, *.mo files.
  * po/uk/LC_MESSAGES/:
    - Update  Ukrainian translation.
  * po/ru/LC_MESSAGES/:
    - Update Russian translation.

  [ Frans Spiesschaert ]
  * debian/po/nl.po:
    + Update Dutch translations. (Closes: #1108670).
  * po/nl/LC_MESSAGES/:
    - Add Dutch translations for loginmenu, FAI installer, etc.
  * fai/config/:
    - Add/complete FAI installer support for nl_NL, nl_BE and fr_BE locales.

  [ Américo Monteiro ]
  * debian/po/:
    + Update Portuguese translations. (Closes: #1108132).
  * po/pt/LC_MESSAGES/:
    - Add Portuguese translations for loginmenu, FAI installer, etc. (Closes:
      #1108132).

  [ Camaleón ]
  * po/es/LC_MESSAGES/:
    - Update Spanish translations for loginmenu, FAI installer, etc.

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 03 Jul 2025 10:24:47 +0200

debian-edu-router (2.13.2) unstable; urgency=medium

  * debian/debian-edu-router-plugin.content-filter.postinst: Create SSL MitM CA
    before initializing squid SSL DB:
    With the previous code path, the SSL DB got initialized (which is
    possible without the CA), then SSL MitM CA creation got triggered
    including a clean-up of the SSL DB prior to creating the CA.
    This resulted in SSL DB being wiped again immediately after creation on
    first dpkg --configure run of d-e-r-p.c-f. Re-running dpkg --configure
    of d-e-r-p.c-f would then skip CA generation and finally create the
    squid SSL DB.
    Changing the order of SSL MitM CA creation (first!) and SSL DB creation
    (second!) fixes this issue.
  * lintian: Adjust file numbers in overrides.

 -- Mike Gabriel <sunweaver@debian.org>  Wed, 18 Jun 2025 14:49:18 +0200

debian-edu-router (2.13.1) unstable; urgency=medium

  [ Daniel Teichmann ]
  * d-e-r-p.mdns-reflector.postinst: Move uif snippet files
    '60_d-e-r-p.m-r_mDNS'* to '05_d-e-r-p.m-r_mDNS'*.

  [ Mike Gabriel ]
  * po/: Update translation templates and translation files.
  * debian/po: Update files running debconf-updatepo.
  * lintian: Update file lines in .lintian-override files.

  [ Jean-Pierre Giraud ]
  * debian/po/fr.po: Update French debconf translation. (Closes: #1106103).

  [ Camaleón ]
  * debian/po/es.po: Update Spanish translations. (Closes: #1106106).

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 16 Jun 2025 10:46:30 +0200

debian-edu-router (2.13.0) unstable; urgency=medium

  * FINALIZE FOR DEBIAN 13:

  [ Mike Gabriel ]
  * Finalize for inclusion in Debian 13:
    - conf/debian-edu/debian-edu-router-fai.conf: Default to trixie in config.
    - conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/NFSROOT: Adjust
      according to requirements in Debian 12 and Debian 13 FAI.
    - Comment-out development APT repo, hint towards FAI upstream repo (in case
      it's needed).
    - conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/NFSROOT: Move
      memtest86+ to DEBIAN_13-only installation block. We observed problems
      when creating bookworm based FAI installer images during grub.cfg
      creation.
  * Prepare for trying-out Debian 14 once it becomes available:
    - conf/debian-edu/debian-edu-router-fai.conf: Hint that forky is already a
      supported distro codename (in theory).
    - fai/config/class/DEBIAN_{14,forky}.var: Prepare for Debian 14.
    - conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/apt/sources.list.in:
  * Pre-release clean-ups:
    - fai/config/package_config/NTP_SERVER: Drop NTP_SERVER class, not needed
      (systemd-timesyncd is just fine).
    - fai/config/package_config/{FIREWALL,GATEWAY}: Move uif package into
      GATEWAY class (and drop FIREWALL package config).
    - fai/config/class/z20_debian-edu-router.profile: Drop classes FIREWALL,
      DNS_SERVER, NTP_SERVER. They have been replaced by GATEWAY class a long
      time ago.
  * lintian: Update several overrides to new release.

  * LOCALIZATION:

  [ Mike Gabriel ]
  * Typo fix: Correct the spelling of the word separate.
  * Run debconf-updatepo. (Closes: #1105914).
  * Run debconf-updatepo once again after all translation updates had
    been applied.
  * Update German translation.
  * Fix Portuguese translation. Apply the correct file version
    now.
  * fai/: Mark de_DE.UTF-8 as fully supported languaged in FAI installer.

  [ Carles Pina i Estany ]
  * debian/po: Add po-debconf Catalan translation. (Closes: #1105963).

  [ Camaleón ]
  * po/es: Update Spanish translations. (Closes: #1102662).
  * debian/po/es.po: Update Spanish translation. (Closes: #1104795).

  [ Frans Spiesschaert ]
  * debian/po/nl.po: Update Dutch translation. (Closes: #1103907).

  [ Américo Monteiro ]
  * debian/po/pt.po: Update Portuguese translation. (Closes: #1103447).

  [ Serhii Horichenko ]
  * debian/po/uk.po: Add Ukrainian translation.
  * debian/po/ru.po: Add Russian translation.
  * po/ru: Add initial translation.
  * po/uk: Add initial translation.

  * COPYRIGHT ATTRIBUTIONS:

  [ Mike Gabriel ]
  * debian/copyright:
    + Update auto-generated copyright.in file.
    + Update copyright attributions.

  * BUG FIXES:

  [ Mike Gabriel ]
  * conf/systemd/squid_d-e-r-p.k-c.conf: Fix key name (ExecPreStart= ->
    ExecStartPre=).
  * debian/debian-edu-router-plugin.content-filter.postinst: Typo fix in
    variable name (filterlists_file -> filterlist_file).
  * README.md: For ISO image creation instruct to install debian-edu-router-
    fai with --no-install-recommends apt-get option. Otherwise, fai-server
    will pull in various network service (e.g. a DHCP server) which might
    cause unwanted problems on local networks.
  * debian/control: Move utilities for creating FAI installer ISO images
    to Depends: field, so that they even get installed if installing
    debian-edu-router-fai without recommended packages (see entry above).

  * UPSTREAM DEVELOPMENT (REGRESSION FIX / REWRITE):

  [ Mike Gabriel ]
  * Bring back e2guardian filterlist support (and various related fixes)
    if SSL bumping is enabled, support fluent switching between e2guardian
    and squid filterlists:
    - debian/debian-edu-router-plugin.content-filter.{config,templates}:
      Blacklists auto-refreshing is for squid and e2guardian. Mark it as such
      in comments.
    - debian-edu-router_refresh-blacklists.sh: Rename to
      debian-edu-router_refresh-blacklists_squid.sh.
    - bin/debian-edu-router_refresh-blacklists.sh: Re-add, but now as a wrapper
      script.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Re-add script
      (from commit fcf1c63e).
    - bin/*: Set LANG to 'C.UTF-8', not 'c'.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Update copyright
      header.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Various variable
      syntax hardenings.
    - bin/debian-edu-router_refresh-blacklists.sh: In addition to the debian-
      edu-router_refresh-blacklists_squid.sh now also wrap the debian-edu-
      router_refresh-blacklists_e2guardian.sh script.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Fix spelling
      error in variable name.
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Align
      path naming scheme of WORK_DIR.
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Align
      path naming schema of SELECTED_CATEGORIES_DIR.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh:
      Use LISTS_DIR pathname that can be recognized as e2guardian-specific.
    - Re-introduce data/templates/header_{blacklisted,whitelistd}_categories
      header templates (required for e2guardian filter config generation).
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Rename variable
      and cmdline option (REMOVE_BLACKLIST -> REMOVE_BLACKLISTS,
      --remove-blacklist -> --remove-blacklists).
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Use more
      similar path names.
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Use different path for
      squid ACL filterlists and Uni Toulouse derived URL blacklists and
      whitelists.
    - d-e-r-p.c-f: Make filterlists processor (e2guardian vs. squid) depend on
      whether SSL bumping is enabled (then: e2guardian) or disabled (then:
      squid).
    - debian/debian-edu-router-plugin.content-filter.postinst: Use previously
      defined variables (and harden some variable syntax).
    - debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Add support
      for migrating data created by previous script versions.
    - data/blacklists-toulouse.{e2guardian,squid}: Ship different configuration
      sets for filterlists by Uni Toulouse (depending on whether used by
      e2guardian or squid).
    - debian/debian-edu-router-plugin.content-filter.postinst: Add support for
      switching between filterlist provides (squid vs. e2guardian).
    - conf/debian-edu-router-plugins/d-e-r-p.content-filter.sh: Add loginmenu
      option for removing filterlists.
    - bin/debian-edu-router_refresh-blacklists_squid.sh: During
      remove_blacklist_files() assure that also symlinks get
      removed/cleaned-up.
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Only mark
      FILTERLISTS_PATH with work-in-progress if filterlists get
      updated/downloaded.
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Ensure that
      CURRENT_SQUID_DIR exists / is empty only if filterlists get
      updated/downloaded.
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Ensure filterlist
      directories exist, even if not populated (because all categories are
      commented out).
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Silence script
      entirely if nothing happens (e.g. if in default UPDATE_FILTERLISTS mode
      and no filterlists have been downloaded so far).
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Typo fix in variable
      name.
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Notify
      about what filterlist mechanism is being cleaned up in
      REMOVE_FILTERLISTS mode.
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Add
      support for skipping service restarts.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Also activate
      whitelists if any.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Drop log message
      'Updating blacklists...'. This does not apply in REMOVE_FILTERLISTS
      mode.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Only download
      filterlists from Uni Toulouse if not in REMOVE_FILTERLISTS mode.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Curate
      (add/remove) filterlist includes via symlinks in
      /etc/debian-edu-router/e2guardian.d/lists/common/.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Catch grep
      non-zero exitcode (and ignore it). This can happen if all categories in
      a category list are all commented out. Without this, the script aborts
      silently on a fully commented-out category file.
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Indentation fixup in
      generate_squid_acl_file() function.
    - debian/debian-edu-router-plugin.content-filter.prerm: Use
      'debian-edu-router_refresh-blacklists --purge-filterlists' (the wrapper
      script + purge) instead of individual scripts and the '...
      --remove-filterlists' cmdline arg.
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Add
      support for purging filterlists.
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Rename
      variables (blacklists -> filterlists).
    - conf/debian-edu-router-plugins/d-e-r-p.content-filter.sh: Edit selected
      categories depending on which service (squid, e2guardian) is in charge
      of blacklisting/whitelisting.
    - bin/debian-edu-router_refresh-blacklists_squid.sh: Make the
      one-category-per-line categories files the primary source of truth and
      derive a shellinclude .sh file from it for sourcing.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Skip
      blacklisted/whitelisted categories (e2guardian) if not listed in
      default_selected_{blacklisted,whitelisted}_categories.
    - debian/debian-edu-router-plugin.content-filter.install: Install
      default_selected_{blacklisted,whitelisted}_categories to DATADIR (and
      not to LOCALSTATEDIR).
    - bin/debian-edu-router_{acl-watcher.sh,refresh-blacklists_e2guardian.sh}:
      Log exactly what service restarts happen when updating filterlists.
    - data/blacklists-toulouse.squid/selected_categories/
      default_selected_blacklisted_categories: Warn about enabling too many
      filtering categories when using squid-based filtering.

  [ Daniel Teichmann ]
  * Bring back e2guardian filterlist support (and various related fixes)
    if SSL bumping is enabled, support fluent switching between e2guardian
    and squid filterlists:
    - debian/d-e-r-p.c-f.postinst: Do not purge filterlists, but remove them, to
      save category selection files. (When switching between e2guardian and
      squid based filtering).
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: Keep
      LISTS_DIR and WORK_DIR in REMOVE_FILTERLISTS mode, only wipe them in
      PURGE_FILTERLISTS mode.
    - data/templates/header_{black, white}listed_categories: Update copyright
      header again.
    - bin/d-e-r_refresh-blacklists_squid.sh: Actually remove 26th Squid ACL
      snippet file ${SNIPPETS_PATH}/26_squid_acls.toulouse_d-e-r-p.c-f.conf
      if not in use.
    - bin/debian-edu-router_refresh-blacklists.sh: Add d-e-r common shell
      functions / variables.
    - bin/debian-edu-router_refresh-blacklists_e2guardian.sh: Only do
      notice_log, if its actually appropriate.
    - bin/debian-edu-router_refresh-blacklists_{e2guardian,squid}.sh: If script
      is not used, show this at least in a single notice_log line of output.
    - conf/debian-edu-router-plugins/d-e-r-p.content-filter.sh: Show the type of
      filterlists (e2guardian vs. squid) in the MANUALLY_REFRESH_BLISTS
      loginmenu item.
    - conf/debian-edu-router-plugins/d-e-r-p.content-filter.sh: Improve inline
      docs. Make it easier to recognize menu item names.
    - bin/debian-edu-router_refresh-blacklists*.sh: Move squid ACL watcher
      inhibitor and re-trigger code into bin/debian-edu-router_refresh-
      blacklists.sh wrapper script.
    - The squid ACL watcher re-trigger is also required when switching away from
      squid-based filterlists over to e2guardian-based filterlists.

 -- Mike Gabriel <sunweaver@debian.org>  Tue, 10 Jun 2025 17:47:35 +0200

debian-edu-router (2.13.0~beta7) unstable; urgency=medium

  [ Daniel Teichmann ]
  * debian/debian-edu-router-{config,plugin.mdns-reflector}.templates: Add small
    adjustments.
  * debian/po: Run 'debconf-updatepo'.
  * debian/po/de.po: Completely review german translation file.
  * debian/po/de.po: Manually adjust and fix some german translation strings.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 05 May 2025 12:56:48 +0200

debian-edu-router (2.13.0~beta6) unstable; urgency=medium

  * debian/*.templates: Fix syntax issues in .templates files of d-e-r-config
    and d-e-r-p.ldap-connector.
  * debian/po/: Regenerate files via debconf-updatepo.
  * lintian: Update line numbers in various overrides, add one more override.

 -- Mike Gabriel <sunweaver@debian.org>  Sat, 03 May 2025 15:42:15 +0200

debian-edu-router (2.13.0~beta5) unstable; urgency=medium

  [ Mike Gabriel ]
  * ChangeLog: post-release update.
  * po/es/LC_MESSAGES/: Add Spanish translations for login menu and FAI
    installer (see #1102662).
  * debian/po/: Run debconf-updatepo.

  [ Daniel Teichmann ]
  * *: s/http/HTTP  +  s/https/HTTPS
  * debian/*.templates: Make changes suggested by the review from 'Justin B.
    Rye'. (THANK YOU!!!)
  * po/*.pot: Make changes suggested by the review from 'Justin B. Rye'. (THANK
    YOU!!!)
  * Run './update-pot.sh'.
  * Run './update-po.sh'.
  * debian/po: Run 'debconf-updatepo'.

 -- Mike Gabriel <sunweaver@debian.org>  Fri, 02 May 2025 13:57:24 +0200

debian-edu-router (2.13.0~beta4) unstable; urgency=medium

  [ Mike Gabriel ]
  * ChangeLog: post-release update for 2.13.0~beta3.
  * debian/po/es.po: Update file. Thanks to Camaleón. (Closes: #1102188).
  * debian/po/: Add Portueguese debconf translation. Thanks to Américo Monteiro.
    (Closes: #1101530).
  * debian/po/: Add French debconf translation. Thanks to Jean-Pierre Giraud.
    (Closes: #1061985).
  * debian/copyright: Update copyright attributions.

  [ Daniel Teichmann ]
  * d-e-r-p.c-f.postinst: Do not delete squid snippet file in /etc/.., which
    gets installed by dpkg.
  * d-e-r-p.c-f.postinst: Prepare filterlists.d regardless of if the plugin is
    enabled or not.

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 10 Apr 2025 00:16:39 +0200

debian-edu-router (2.13.0~beta3) unstable; urgency=medium

  * Upload to unstable.

  [ Mike Gabriel ]
  * conf/apache2/conf-available/debian-edu-router-deployserver.conf:
    Drop '-deployserver' from download URL of ISOs, squashfs images and FAI
    configspace tarballs.
  * bin/debian-edu-router-fai_mkconfigspacetarball (et al.): Adjust filename of
    the FAI configspace tarball slightly ('.' vs. '_').
  * bin/debian-edu-router-fai_release: Add script. Support building staging
    installer files that can be released on demand.
  * debian/po/:
    + Update template.pot file.
    + Update translation files after templates.pot update.
  * debian/copyright:
    + Update auto-generated copyright.in template file.
    + Update copyright attributions.
  * lintian: Various adjustment for this release.

  [ Daniel Teichmann ]
  * d-e-r-p.mdns-reflector.postinst:  warning_log -> notice_log;  warning_log
    -> error_log;
  * d-e-r-p.c-f: Rename e2guardian-refresh-blacklists related stuff to squid-
    refresh-blacklist or similar.
  * d-e-r-p.c-f.postinst: Rename 'restart_e2guardian_autorefresh_blacklists'
    to 'restart_autorefresh_blacklists'.
  * bin/debian-edu-router_refresh-blacklists.sh: Update copyright header.
  * bin/debian-edu-router_refresh-blacklists.sh: Completely rewrite script.
  * D-E-R-P.C-F: Completely rework selection process of black/whitelist
    categories.
  * bin/debian-edu-router_refresh-generated-ips.sh: Fix small whitespace
    bug in debug_log.
  * d-e-r-p.c-f.postinst: Remove /etc/squid/snippets.d/25_squid_acls.generated_
    d-e-r-p.c-f.conf file, if autogenerate IPs task is turned off.
  * bin/debian-edu-router_acl-watcher.sh: Rewrite script.
  * bin/debian-edu-router_acl-watcher.sh: Update copyright header.
  * d-e-r-p.c-f.postinst: Remove unused ACL debugging comments in Squid config.
  * D-E-R-P.C-F: Remove legacy blacklists.d references and update e2guardian
    list paths.
  * conf/e2guardian/e2guardian{f1.conf,.conf.in}: Update __LISTDIR__ paths.

 -- Mike Gabriel <sunweaver@debian.org>  Fri, 28 Mar 2025 23:08:18 +0100

debian-edu-router (2.13.0~beta2) experimental; urgency=medium

  [ Mike Gabriel ]
  * Debian Edu Router code:
    - Prepare for trixie (and for forky, rudimentarily).
    - conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/NFSROOT: Adopt various
      additions/changes from FAI upstream.
  * Packaging:
    + debian/debian-edu-router-plugin.content-filter.lintian-overrides:
      Upload line number of maintainer-script-calls-service override.
    + debian/debian-edu-router-deployserver.dirs: Create dirs exported via
      httpd.
    + debian/control: Use Git repo in Homepage: field for now. (LP:#2100822).

  [ Daniel Teichmann ]
  * Debian Edu Router code:
    - d-e-r-p.c-f: Drop debian-edu-router.conf file into /etc/default/uif.d/;
      Set default FILTER_COMMAND="iptables-legacy".
    - Makefile.iso: Smaller adjustments. Make *-globs more specific.
    - debian/debian-edu-router.common: Add generate_unique_pairs() function.
    - d-e-r-p.m-r.templates: Add templates for Googlecast, Miracast, AirPrint,
      AirPlay, IPP@Everywhere.
    - d-e-r-p.m-r.config: Add statemachine logic for new templates of firewall
      services.
    - d-e-r-p.m-r.postinst: Implement logic for new firewall service questions.
    - d-e-r-p.m-r.postinst: Change logging verbosity to WARNING. Reduces a lot
      of very verbose messages.
    - d-e-r-p.m-r.postinst: Instead of just restarting mdns-reflector, ENABLE +
      RESTART the service.
  * Packaging:
    + debian/control: Fix 'Breaks: ' field of d-e-r-common.

 -- Mike Gabriel <sunweaver@debian.org>  Tue, 18 Mar 2025 17:07:27 +0100

debian-edu-router (2.13.0~beta1) experimental; urgency=medium

  * Upload to experimental.

  [ Daniel Teichmann ]
  * Add plugin: debian-edu-router-plugin.mdns-reflector (d-e-r-p-m-r).
  * Add plugin: debian-edu-router-plugin.content-filter (d-e-r-p-c-f).
  * Add plugin: debian-edu-router-plugin.ldap-connector (d-e-r-p-l-c).
  * Add plugin: debian-edu-router-plugins.krb5-connector (d-e-r-p-k-c).
  * Factor-out various functionalities to debian-edu-router-common bin:pkg.
  * Improve logging and debug support.
  * debian/d-e-r.common: Enforce debug msgs if /etc/debian-edu-router/debug was
    found.
  * d-e-r-loginmenu: Introduce plugin support.
  * d-e-r-loginmenu.sh: Stay consistent with unicode triple-dots (…) and
    normal ones (...).
  * loginmenu: Add options which toggle plugin's functionality.
  * loginmenu: Do not skip directly to main menu if in plugin menu.
  * loginmenu: Add option to toggle debug messages.
  * loginmenu: Introduce indicator, if plugin is enabled or not, in the plugin
    submenu.
  * loginmenu: Add 'etckeeper' support for plugins.
  * loginmenu: Add visual way of telling if task of a plugin is activated/
    deactivated.
  * loginmenu: Support showing system logs.
  * loginmenu: Introduce new option to show DHCP leases of dnsmasq.
  * conf/debian-edu-router-plugins/d-e-r-p.example.sh: Add example plugin
    metadata file.
  * debian-edu-router-config: Various refactorings regarding network
    configuration management. (E.g. per-interface dnsmasq service units)
  * Improve and adjust Makefile.debug for 2.13.0 release.
  * Improve and adjust Makefile.iso for 2.13.0 release.
  * debian/d-e-r-c.common: Fix bug where different shells would produce
    different outputs in compare_comma_separated_items.
  * debian/d-e-r-c.config: Fix VLAN needed-ifaces calculations and show error
    dialog if too few interfaces are available.
  * debian/d-e-r-c.postinst: Show an easy copy&paste-able command to restore
    backed-up configuration after a service restart failure.
  * debian/d-e-r-c.config: Fix iface assignment message. (Iface was 'ok'
    every time).
  * debian/d-e-r-c.config: Allow user to cancel (back up) iface assignment.
  * debian/d-e-r-c.config: Bailout if interface assignment for VLAN is not
    successful after 5 tries.
  * debian/d-e-r-c.config: Fix step-by-step mode for iface assignment of
    internal networks.
  * debian/d-e-r-c.config: Reset VLAN iface debconf question if not using VLANs.
  * debian/d-e-r-c.common: Fix get_internal_networks_ifaces() not considering
    VLANs.
  * debian/d-e-r-c.common: Add option to not lowercase network names in
    get_internal_networks{_ifaces}.
  * debian/d-e-r.common: Add filter_item() function.
  * Add 'debian-edu-router-reconfigured' dpkg trigger. Reconfigure plugins
    packages when aforementioned trigger got activated.
  * debian/d-e-r-c.postinst: Remove plugin related config files before
    generating our own.
  * debian/d-e-r-c.postinst: If 'SKIP_SERVICE_RESTARTS_POSTINST' is set, also
    skip stopping networking service!
  * bin/debian-edu-router-fai_updateconfigspace: Fix quoting typo in git
    command.
  * docs/{webcache.md.in,squid_ACLs_explained.md.in}: Provide detailed content
    filter documentation.
  * debian/d-e-r-p.*.postinst: Unify code style (configure_package).
  * debian/d-e-r-c.config: Fix issue where step-by-step setup would be stuck in
    a loop.
  * debian/d-e-r-c.postinst: Fix issue where aborting an upgrade would
    make postinst fail completely.
  * data/filterlists.d/ProxyAllowSite.dist: Add '.debian.org' as always allowed
    and trusted website.
  * Debconf templates: Replace all occurrences of 'Debian Edu Router' to improve
    product branding. (D-E-R is brandable and can be renamed by vendors).
  * Project Wide: Use '/usr/lib/systemd/system/' instead of
    '/lib/systemd/system/'.
  * fai/config/debconf/DEBIAN_EDU_ROUTER: Add preseedings for Debian Edu Router
    Plugins.
  * fai/config/debconf/DEBIAN_EDU_ROUTER: Fix preseedings for VLAN IDs.
  * fai/config/files/etc/hosts/DEBIAN_EDU_ROUTER: Add tjener.intern (and
    ldap, www, ...) to /etc/hosts.
  * All plugins: Add general should-plugin-be-enabled question.
  * fai/config/class/z20_debian-edu-router.profile: Fix default selection.
  * fai/config/files/etc/debian-edu-router/debug/DEVELOPMENT: Add file; Force-
    Enable debugging mode, if DEVELOPMENT class was selected.
  * Add Debian Edu Skolelinux logo to /usr/share/debian-edu-router/logos/
    00_debian-edu-router_logo.svg (and use it in error pages when squid blocks
    internet access).
  * docs/squid_ACLs_flowchart.{svg, drawio}: Add schematics of the content
    filter engine.
  * bin/debian-edu-router-loginmenu.sh: Show version in addition to PRODUCTNAME
    and MACHINE_ID.
  * FAI conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/grub.cfg: Update
    file.
  * d-e-r-f grub.cfg.temp: Add background image and DejaVuSansMono font.
  * update-po{t}.sh: Use po/DOMAINS file to keep track of GETTEXT_DOMAINS.
  * All systemd services: Declare dependency on network-online.target.
  * bin/debian-edu-router-loginmenu.sh: Add button for starting 'htop' utility.
  * Update copyright notices in various files.
  * debian/control:
    + Add various 'Suggests' and 'Enhances' fields.
    + Add openssh-{client, server} as dependencies.
    + Move dnsmasq from Recommends: to Depends:.
    + Add to Depends: Add netcat-openbsd.

  [ Mike Gabriel ]
  * bin/debian-edu-router-fai_updateconfigspace: More reliably detect if we are
    in a Git working copy.
  * debian/copyright: Update copyright attributions.
  * debian/copyright: Update auto-generated copyright.in file.
  * lintian: Introduce more overrides where appropriate.
  * Make FAI installer localizable.
  * fai/config/class/: Support switching to another locale in FAI installer
    dialogs based on classes set in FAI profiles.
  * debian/: Split-out translation files of debian-edu-router-fai into its own
    bin:pkg (debian-edu-router-fai-l10n, to be installed in the FAI nfsroot).
  * debian/: Refactor how .po files get generated into .mo files and how they
    get installed into the bin:pkgs.
  * Various FAI installer improvements and bug fixes.
  * Make PRODUCTNAME partially localizable, rework how the PRODUCTNAME is
    printed on screen in plugins.
  * fai/config/package_config/DEBIAN: Make sure rsyslog is installed.
  * debian/README.i18n{,md}: Provide i18n guidelines for fully localizing
    debian-edu-router.
  * debian/control:
    + Add d-e-r-common to Pre-Depends: of d-e-r-common and d-e-r-fai
      bin:pkgs.
    + Add 'ssl-cert' to Pre-Depends: of d-e-r-plugin.content-filter.
    + debian/control: Pre-depend on debconf (for all bin:pkgs with
      debconf calls in preinst scripts.
    + Sort package names in D:/R: fields.
    + Add to R: (d-e-r-config): gpm.
    + Line-wrap S: field (d-e-r-config).
    + Add to R (content-filter): squid-langpack.
    + Bump Standards-Version: to 4.7.2. No changes
      needed.
  * debian/po/:
    + Update debconf dialogs translation files.
  * debian/*.templates: Fine-tune English translation templates for upload.
    Thanks, lintian. (fa54d887)
  * debian/*.lintian-overrides: Update lintian overrides. (fb7b43f3)
  * debian/debian-edu-router-plugin.content-filter.{postinst,postrm}: Drop
    backup/removal and restore of /etc/squid/conf.d/debian.conf.
  * conf/squid/snippets.d/01_squid_base_d-e-r-p.c-f.conf: Define localnet ACL
    so that /etc/squid/conf.d/debian.conf does not have to be removed.

  [ Temuri Doghonadze ]
  * po/: Add Georgian translations. (Many thanks from the upstream authors!!!).

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 10 Mar 2025 11:25:20 +0100

debian-edu-router (2.12.8) unstable; urgency=medium

  [ Daniel Teichmann ]
  * debian/d-e-r-c.postinst: Fix dnsmasq conf generation for networks over VLAN.
  * debian/d-e-r-c.config: Fix QCOUNT typo. (Prevents always showing not-
    implemented dialog). (Closes: #1049329).
  * debian/d-e-r-c.postinst: Only generate UIF filter rules for SSH if 'Uplink'
    interface is defined. (Closes: #1050231).

  [ Mike Gabriel ]
  * Adjust script name in README and print output (d-e-r-faiinstall -> d-e-r-
    fai_install).
  * debian/po:
    + Add pt_BR translation. Thanks to Paulo Henrique de Lima Santana. (Closes:
      #1037129).
    + Add sv.po. Thanks to Peter Kvillegård. (Closes: #1049959).
    + Add nl.po. Thanks to Frans Spiesschaert. (Closes: #1041874).
  * lintian: Adjust file lines in overrides.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 11 Sep 2023 13:01:21 +0200

debian-edu-router (2.12.7) unstable; urgency=medium

  * d-e-r-c.postrm: Fix /etc/dnsmasq.d/ path name in comment.
  * debian/po/:
    + Update es.po. Thanks to Camaleón. (Closes: #1035682).
    + Update de.po.

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 15 May 2023 23:47:17 +0200

debian-edu-router (2.12.6) unstable; urgency=medium

  [ Daniel Teichmann ]
  * debian/d-e-r-c.{config,templates}: Add debian-edu-router-config/service-ssh-
    custom-port dialog & template.
  * debian/d-e-r-c.postinst: Generate sshd + uif config files for custom SSH
    port.
  * debian/d-e-r-c.postrm: Purge d-e-r related SSH service config files.
  * debian/d-e-r-c.postinst: Generate uif service definition (SSH custom port).
  * debian/d-e-r-c.postinst: Don't generate firewall rules, if SSH service is
    disabled.
  * debian/d-e-r-c.postinst: Replace sshd with ssh for invoke-rc.d call.
  * debian/d-e-r-c.config: Make sure user doesn't accidentely quit the conf
    dialog when trying to backup…
  * debian/d-e-r-c.postinst: Make nosetup_reason2 message bold.

  [ Mike Gabriel ]
  * debian/po: Update nl.po. Thanks to Frans Spiesschaert. (Closes: #1033906).
  * debian/debian-edu-router-config.config: Grammar fix.
  * debian/debian-edu-router-config.templates: Add EOL at EOF.
  * debian/d-e-r-c.{config, postinst}: Selectively allow/block incoming SSH
    connections.
  * debian/debian-edu-router-config.config: White-space fixes.
  * debian/debian-edu-router-config.config: Fix wrong debconf screen numbers
    that got broken by cherry-picking.
  * debian/po: Add pt_BR translation. Thanks to Paulo Henrique de Lima Santana.
    (Closes: #1034029).
  * debian/debian-edu-router-config.postinst: Assure enabling of SSH service in
    case it got disabled beforehand.
  * debian/debian-edu-router-config.postinst: Use update-rc.d instead of
    systemctl for disabling ssh service.
  * debian/debian-edu-router-config.lintian-overrides: Update line number in
    recursive-privilege-change override. Add various update-rc.d override.
  * debian/po/: Update translation files.
  * debian/debian-edu-router-config.postinst: Silence stdout/stderr of
    update-rc.d. Thanks, lintian.
  * debian/debian-edu-router-config.postinst: Ignore failures of update-rc.d
    when (re-)enabling ssh service.
  * debian/debian-edu-router-fai.lintian-overrides: Silence false-positive
    lintian reports.
  * debian/po/: Update es.po. Thanks to Camaleón. (Closes: #1034706).
  * debian/d-e-r-config.{postinst,postrm}: Assure that /etc/ssh/sshd_config.d/
    exists when needed, purge it again if probably created by us.
  * debian/d-e-r-config.postrm: Purge /etc/dnsmasq.d/ again if probably
    created by us.

 -- Mike Gabriel <sunweaver@debian.org>  Wed, 26 Apr 2023 08:26:22 +0200

debian-edu-router (2.12.5) unstable; urgency=medium

  [ Daniel Teichmann ]
  * Makefile.iso: Split CHROOT_LOCATION via 'tr' to avoid possible
    'Union Directory' entries.
  * debian/d-e-r-c.postinst: Remove 'WARNING' from skip-network-setup msg to
    avoid it being shown at FAI installation.
  * debian/d-e-r-c.config: Remove old color codes and replace them with new
    color variables.
  * debian/d-e-r-c.config: Make bailout_on_too_many_failures() colorful.
  * {po/de.po, po/templates.pot, debian/d-e-r-config.templates}: Update
    translation.
  * debian/d-e-r-c.config: Make DNS nameserver question more reliable + support
    IPv6.
  * debian/d-e-r-c.config: IPv4 DNS NS's can provide IPv6 NS's and vice versa.
    So don't force both IPv4 and IPv6 nameservers.
  * debian/d-e-r-c.lintian-overrides: udevadm guard warning has been fixed.
  * debian/d-e-r-c.postrm: Set title to 'Debian Edu Router'.
  * debian/d-e-r-c.{templates,config,lintian-overrides}: Remove
    debian-edu-router-config/title.
  * debian/d-e-r-c.config: Add '|| true' guard to udevadm call. Thanks, Lintian.
  * debian/d-e-r-config.templates: Don't break '_Description:' line. Update
    translation.
  * po/{de.po,templates.pot}: Update template language files.

  [ Mike Gabriel ]
  * package_config/DEVELOPMENT.{asc -> gpg}: Rename file. Support for .asc files
    has been dropped in FAI.
  * fai/config/_obsolete-files.d/debian-edu-router-fai.removed: Mark
    package_config/DEVELOPMENT.asc as obsolete file.
  * bin/debian-edu-router-fai_instal: Mount /proc and /sys in nfsroot prior to
    creating/updating it. Those mountpoints are needed by dracut's 45url-libs
    module.
  * debian/copyright: Adjust for renamed DEVELOPMENT.{asc|gpg} file.
  * bin/debian-edu-router-fai_*: Drop support for Debian versions older than
    bullseye.
  * bin/debian-edu-router-fai_install: Drop non-free-firmware repo area if
    preparing a bullseye nfsroot.
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/NFSROOT: Forward-port
    changes from NFSROOT in FAI 6.0.
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/NFSROOT: Add libnss3.
    Required by dracut's 45url-libs module.
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/apt/sources.list.in:
    Add non-free-firmware package repo area.
  * fai/config/package_config/: Temporarily stop using 'aptitude' installation
    type, switch to legacy 'install' (i.e. apt-get).
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/nfsroot.conf.in: Drop
    '--include=aptitude' from FAI_DEBOOTSTRAP_OPTS. Not supported by FAI 6.0
    currently.
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/nfsroot.conf.in: Add
    '--include=ca-certificates' to FAI_DEBOOTSTRAP_OPTS. For https deb-URLs it
    is vital to have ca-certificates already installed in FAI's base.tar.xz
    chroot tarball.
  * fai/config/package_config/FAIBASE: Drop libnss-sss and libpam-sss. (Remnant
    from Debian LAN which we used as a starting point).
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/grub.cfg: Mark
    simultaneous DHCP discovery as experimental, not BROKEN. It has been working
    quite well during recent tests.
  * debian/debian-edu-router-config.postinst: Assure that /etc/dnsmasq.d/ exists
    before placing files into it.
  * debian/debian-edu-router-config.postinst: Silence and ignore errors if
    /etc/dnsmasq.d/ is empty when attempting to remove files from it.
  * fai/config/class/90-development: Disable DEVELOPMENT class.
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/apt/sources.list.in:
    Comment out DEVELOPMENT APT repository.
  * conf/debian-edu/fai/debian-edu-router-fai.TEMPLATE/apt/trusted.gpg.d/:
    Rename itzks-keyring.gpg to DEVELOPMENT.gpg
  * fai/config/class/90-development: Disable DEVELOPMENT class.
  * debian/debian-edu-router-config.lintian-overrides: update line number.

  [ Camaleón ]
  * debian/po: Add es.po. Thanks to Camaleón. (Closes: #1033016).

  [ Frans Spiesschaert ]
  * debian/po: Add nl.po. Thanks to Frans Spiesschaert. (Closes: #1032534).

 -- Mike Gabriel <sunweaver@debian.org>  Mon, 20 Mar 2023 08:49:18 +0100

debian-edu-router (2.12.4) unstable; urgency=medium

  [ Daniel Teichmann ]
  * debian/d-e-r-c.config: Replace old remnants of 'backbone' with 'mgmt'.
  * debian/d-e-r-c.templates: Fix typo in the 'Printers' DHCP example.
  * debian/d-e-r-c: Restrict the firewall so that you can no longer connect to
    other internal networks directly.
  * Makefile.debug: Add packages 'gpm' + 'ipv6calc'; Fix package 'ip4calc' ->
    'ipcalc'.
  * bin/debian-edu-router-loginmenu.sh: Add 'completely configure d-e-r' option.
  * fai/config/debconf/DEBIAN_EDU_ROUTER: Fix one of the debconf preseedings.
    (papercut).
  * debian/d-e-r-c.postinst: Refactor echo log-statements to 'debug_log' or
    'error_log' func calls.
  * debian/d-e-r-c.postinst: Rephrase port-is-already-in-use warning_log.
  * debian/d-e-r-c.postinst: If 'D_E_R_DEBUG' is set, don't just delete
    generated config files.
  * debian/d-e-r-c.{config,lintian-overrides}: Fix vlan template typo.
  * po/de: Update german language files.
  * po/: Execute ./update-pot.sh (Update language files).
  * debian/po/*: Execute debconf-updatepo (Update language files).
  * debian/po/de.po: Update german language files.
  * po/de/LC_MESSAGES/debian-edu-router-config.po: Make loginmenu strings more
    uniform.
  * debian/d-e-r-c.common: Add warning_log_stderr().
  * debian/d-e-r-c.config: Don't run preconfigure stage, because commons file
    is not yet ready.
  * debian/d-e-r-c.config: Wait for iface link to be up before continuing.
  * debian/d-e-r-c.config: Add set_all_available_ifaces_up() and add a little
    documentation.
  * debian/d-e-r-c.{config,templates}: Step-By-Step: Optimize Uplink interface
    gathering.
  * debian/d-e-r-c.config: Step-by-Step: Fix bug where iface could be empty for
    internal network iface matching.
  * debian/d-e-r-c.postinst: Remove leftover reference of removed template
    'debian-edu-router-config/net-connect-ext-iface-uplink'.

  [ Mike Gabriel ]
  * debian/debian-edu-router-config.templates: Shorten SHORT_DESCRIPTION fields
    to be under 78 chars long.
  * lintian: Drop too-long-short-description-in-templates overrides.
  * lintian: Adjust line numbers of some overrides.
  * debian/debian-edu-router-config.templates: Wrap too-long-lines in
    LONG_DESCRIPTION fields. (No change in the wording).
  * debian/po/templates.pot: Update file.
  * debian/po/: Update de.po.

 -- Mike Gabriel <sunweaver@debian.org>  Thu, 16 Feb 2023 08:03:50 +0100

debian-edu-router (2.12.3) unstable; urgency=medium

  * debian/control: Add to D (d-e-r-c): procps (provides sysctl cmd).
    (Closes: #1030574).

 -- Mike Gabriel <sunweaver@debian.org>  Sun, 05 Feb 2023 21:28:34 +0100

debian-edu-router (2.12.2) unstable; urgency=medium

  * debian/debian-edu-router-config.postinst: Create directory /etc/sysctl.d
    before writing a file into it. (Closes: #1030359).
  * fai/config/files/lib/systemd/system/startup-shutdown-chiptune.service/
    GATEWAY: Add license header.
  * debian/copyright: Update copyright attributions.
  * debian/debian-edu-router-config.postrm: Assure purging of our sysctl config
    snippet.
  * lintian: Adjust line number in recursive-privilege-change override.

 -- Mike Gabriel <sunweaver@debian.org>  Sat, 04 Feb 2023 15:33:09 +0100

debian-edu-router (2.12.1) unstable; urgency=medium

  [ Daniel Teichmann ]
  * FAI: Move startup-shutdown-chiptune.service to /lib/systemd/system/ and
    execute fcopy on it.
  * bin/debian-edu-router-loginmenu.sh: Fix 'ITEM_REBOOT_REBOOTING_NOW'
    string.
  * po/de/LC_MESSAGES/debian-edu-router-config.po: Fix punctuation typo;
    update pot files.

 -- Mike Gabriel <sunweaver@debian.org>  Wed, 01 Feb 2023 12:25:04 +0100

debian-edu-router (2.12.0) unstable; urgency=medium

  * Initial release. (Closes: #1029988).

 -- Mike Gabriel <sunweaver@debian.org>  Sun, 29 Jan 2023 22:05:00 +0100
