SupiVPN v0.8.2

SupiVPN v0.8.2

This patch keeps confirmed VPN disconnects queued for cancellation across transient
controller/API failures, so the agent can release the occupied session slot when
the API recovers instead of abandoning cancellation after 30 seconds.

Changes since v0.8.1,
including PR #38.
Release commit: a89a1ccaf449b47382d1bfb4ae01f94247d9b2b9.

Changes

• Retain cancellation after OpenVPN confirms disconnection, or a complete ordered
  status response proves the connection is absent, while the node generation's
  lease remains live. A temporary cancellation outage alone no longer stops
  unrelated tunnels after 30 seconds.
• Keep idempotent retries, including a lost reply after cancellation commits.
  Backoff remains capped at 16 seconds, the shared worker at four calls per
  second, and the queue at 32 jobs.
• Add regression coverage for transport errors, HTTP 429/502/503, 90-second
  cancellation outages, lost committed replies, handler replacement, whole-API
  outages and clean generation restart through both Lambda gateway formats.
• Document a read-only query that distinguishes historical acknowledged rows
  from grants that still occupy session slots, plus safe recovery guidance.
• Include the documentation updates and lighter documentation-only CI from
  PRs #35 and #37. Code and release tags retain the full verification pipeline.

Compatibility

Upgrade the agent on each VPN node to receive this fix. Updating Lambda alone
cannot change the node agent's cancellation behavior. The agent API and database
schema are unchanged from v0.8.1; schema 12 remains current, with no new migration
or runtime grants. Existing client profiles remain valid and need no reissue.
No client settings, configuration defaults or OpenVPN binaries change.

For Debian installations, install the v0.8.2 packages and explicitly restart each
configured agent/OpenVPN pair in a maintenance window. Package upgrades leave
running processes untouched. Restart through the owning supivpn-node service
(or its configured instance), then verify readiness and a reconnect. Restarting
a pair disconnects its existing tunnels; update nodes in a controlled sequence.
Retain the node generation journal and do not reuse stale authorization state.
For Lambda-backed installations, update the node agent as well; matching Lambda
artifacts are included, but this patch introduces no Lambda runtime code change.

An upgrade from v0.8.0 or earlier still needs the previously documented
schema 12 migration.
Legacy profile migration remains supported throughout 0.8.x and 0.9.x through
the existing explicit two-port configuration; earliest enforcement remains 0.10.
Rolling back the agent to v0.8.1 restores the old cancellation behavior; no schema
downgrade is needed or provided by this patch.

Recovery and limitations

A slot remains occupied until cancellation commits or a verified clean generation
restart/fencing makes the old grant inactive. This fix does not delete old login
rows or release slots merely because time has passed. Historical acknowledged
rows from an older generation can remain without counting against session limits.

If the entire API is unavailable until the local 40-second lease expires, the
agent still stops. Recovery requires a clean supervised agent/OpenVPN pair restart
or verified fencing. Uncertain applied ACKs, permanent API refusals, stale
generations and exhausted queue capacity still fail closed. Restarting Lambda
alone is not proof that an old VPN tunnel has stopped.

See session diagnostics and recovery.
Do not delete login rows or clear slots based only on age, state or an expired
lease. Verify recovery by disconnecting and reconnecting without manual SQL cleanup.

The reported production incident was not reproduced against the live AWS
deployment. Local fault injection reproduced and fixed a relevant cancellation
defect; it does not establish that every stale-slot incident has the same cause.

Packages

Commit: a89a1ccaf449b47382d1bfb4ae01f94247d9b2b9. License: AGPL-3.0-only.

Verified native ARM64 and AMD64 builds from Checks for this signed tag. Both bundles use format 3.

Debian 13 packages for ARM64 and AMD64, a shared metapackage and native Debian source are included. Install verified matching packages with apt install ./supivpn*.deb; see DEPLOYMENT.md.

GitHub build provenance was verified for all binary archives, Debian assets and Corresponding Source, including the tag commit and Checks run attempt 1.

Database schema: 12; compatible VM schemas: 7, 8, 9, 10, 11, 12.
Isolated Lambda required schema: 12.

Corresponding Source accompanies the binaries. Verify SHA256SUMS.asc with the pinned SupiVPN release key, then verify the downloaded files against SHA256SUMS before use.