Verso 0.8.0

Verso 0.8.0

Verso is highly experimental. Back up your router's configuration before you upgrade.

This release is about finish: the pages speak one language, the Overview says what is wrong, and the Hardware page and every graph are rebuilt.

New

• The Overview names what is wrong. Its heading is the one thing that needs attention, in the words of the card that says it ("Storage is high", "Tunnel wg0 is down"), or how many things do ("2 things need attention"), tinted by how serious it is. Offline still outranks everything. Every card counts, hidden or not, the Hardware card included.
• Hardware, rebuilt. System › Hardware is the board, then one card per kind of reading, each reading once. The Temperatures card charts a reading's history over a window you choose.
• Graphs, rebuilt. Every graph stands on whole cells, names its window's quarters, says its peak and writes its unit once. Download and upload have a lane each, with their own scale.
• Firewall rules say what happens to everything else. Each lane on Firewall › Rules ends with the verdict firewall4 gives traffic none of its rules caught, and a link to where that is set.
• The review says changes in plain words. A changed setting reads as its row did: its name, its new value and its option, never a section handle like cfg01411c.
• The rail opens groups in place. Pressing Firewall, Network or System opens its pages under it without leaving the page you are on.
• A page that is not there says so. An address with nothing at it shows "Page not found" with a way back to the Overview, instead of a bare server line.

Changes

• Firewall › Zones no longer edits the global defaults. It repeated what Firewall › Settings edits, under other names. Settings is the one place to change them.
• System › General saves each card on its own, with "Save router settings" and "Save time settings". The theme still takes effect the moment you pick it.
• One look for every confirmation and notice. Deleting a rule, a zone, a port forward, a reservation, a session or a package asks in the same crimson band as Reboot, and the way back names what it keeps ("Keep rule"). Every notice carries its colour square, and its link reads in its own colour.
• One wording for buttons. Every add reads "Add …" and every settings Save says what it saves.
• Access: the web interface's ports move with "Switch now", so "Apply" only ever means applying staged changes.
• Packages: packages the router cannot boot, keep its configuration or install packages without (base-files, kernel, uci, apk, procd and their kin) can no longer be removed.
• Firewall › Settings stages only what you changed. Saving the page used to stage untouched policies and defaults as changes.
• Durations and units read one way everywhere, a figure and its unit kept together.
• The firmware line says "Not checked since the router started" before the first check after a boot, since the last check's record does not survive a reboot.
• Quieter system log. Verso's own lines carry one timestamp, and a plugin reading a configuration that is not installed no longer logs an error every few seconds.

Changes to your router

• Temperature history is kept under each sensor's kernel name. On the first start after the upgrade, Verso moves the history it already has.

For plugin authors

• The SDK gains Envelope::not_found(), Description::setting(), Widget::reading(), confirm_cancel on row confirmations, close on table lanes and TablePart::Door. See docs/plugins.md.
• A nav entry's pages may list its subpages. A plugin that does needs Verso 0.8.0 or newer.

Upgrade

apk update && apk upgrade

Upgrade the plugins together with Verso.

Verso 0.7.0

Verso 0.7.0

Verso is highly experimental. Back up your router's configuration before you upgrade.

This release is mostly about security: a full audit of Verso, with every finding fixed. It also brings themes, including a dark mode.

Do this after upgrading

Make a new web certificate. Until this release, every plugin could read the private key of the certificate the web interface uses. The upgrade closes the file, but the key stays the same. On Access, press Make a new one, then accept the new certificate in your browser.

New

• Themes and dark mode. Pick the look of the interface on System › General › Appearance. Sand, the default, follows your browser between light and dark, so if your system prefers dark, the interface is now dark. Sand light and Sand dark keep one or the other, and Catppuccin Mocha is a dark theme of its own. A pick is the router's, takes effect at once, and is not one of the changes waiting to be applied.

Security

• No secrets in config history. Config history kept Wi-Fi passwords, RADIUS, 802.11r and WPS secrets, alert addresses and some plugin secrets in plain text, and showed a removed section's secrets in full. It now keeps none of them. On the first start after the upgrade, Verso takes the secrets out of the history already on your router and rewrites the file, so no trace of them stays on disk.
• Config history is private. The history folder and its files are readable by Verso alone. They used to be readable by every account on the router.
• A password change signs out other browsers. Changing an account's password ends every other session of that account, and signing in again from a browser ends the session that browser had.
• Restricted logins see only what they are granted. A login with a limited rpcd ACL no longer sees every LAN device, the usage figures, the config history of configs it may not read, or the sessions of other accounts on Access. A new verso-admin ACL group carries the session and config grants; root keeps everything it had.
• The web interface checks who it talks to. Before it sends anything to the root helper or a plugin, Verso asks the kernel which account is behind the socket, and refuses an impostor. Plugins bundled with Verso moved their sockets to a folder of their own.
• A silent client can no longer starve the web interface. Each listener caps how many connections it holds.
• OpenVPN secrets stay hidden. Every inline block OpenVPN reads is hidden from the web interface, including proxy sign-ins, the auth-token secret and keys behind unusual tags. The connection hook writes its records in a way a planted file cannot disturb.
• Factory reset erases the history wherever it is kept, including a history folder you moved off /data/verso.
• Plugin text cannot carry a script link. A javascript: link in a plugin's Markdown is never rendered as a live link, however it is spelled.
• Updated components. Go 1.27.2, goldmark and x/crypto fix known advisories in code Verso calls. Every release is now checked against the known vulnerability databases before it is published.

Changes to your router

• Config history moves to a new file format (version 8). Verso 0.6.0 and older cannot read it: after a downgrade, config history is kept in memory only and starts empty on every restart.
• After a downgrade, Undo on a removed section whose secret was taken out of the history puts back the text map[secret:true] instead of the secret. Check such a change before you apply it.
• The bundled system, firewall and interfaces plugins listen in /var/run/verso-plugin-<id>/.

Upgrade

apk update && apk upgrade

Upgrade the plugins together with Verso.

New on x86-64? Add the feed and install:

wget -O /etc/apk/keys/verso.pem https://sysupgrade.mono.si/verso/verso.pem
echo "https://sysupgrade.mono.si/verso/x86_64/packages.adb" > /etc/apk/repositories.d/verso.list
apk update && apk add verso

Feedback

Report bugs, suggestions and actionable feedback as GitHub Issues: https://github.com/we-are-mono/verso/issues

Verso 0.6.0

Verso 0.6.0

Verso is highly experimental. Back up your router's configuration before you upgrade.

New

• Every page is cards. The pages now look like the Overview: each section is a card on a sand background. A page that is one list is one card, with its filter and acts along the card's top. There is no longer a grid or a masthead bar behind the page.
• Your router's back panel, live. The Ports card on the Overview opens with a drawing of the router's ports as they sit on the case. Each port's link and traffic LEDs light up as they do on the router, the WAN port is marked in blue, and hovering a port (or focusing it with the keyboard) shows its speed and detail. A router without its own drawing gets a generated panel.
• A System card and a Hardware card. The System card holds the router itself: board, architecture, target platform, firmware, kernel, uptime and local time. On a router whose board lists its sensors (the Gateway), the Hardware card shows the CPU temperature, the main power rail and the main fan, and its header warns about a hot CPU before a stopped fan. Every other reading stays on System › Hardware.
• Durations read one way. Uptime and other lengths of time show their two largest units, such as 45 s, 2 h 14 min or 52 d 8 h. "52 d 08:33" used to look like a time of day. Times in the past read as "5 min ago", or "just now" under a minute.
• A tidier, more even layout. Every control is 32px tall, and text, cards, drawers and dialogs line up on one 8px grid at any window width. Form labels are a step lighter than headings, and text is drawn a little finer, so light text no longer looks heavier than it is.
• A browser icon. Verso now has its own icon for the browser tab, bookmarks and the home screen.

Changes to your router

• A saved Overview layout carries over. The Firmware card is now part of the System card, and a layout that had Firmware shows System where Firmware stood.
• /favicon.ico answers without signing in, as /assets/ already does.

Fixed

• In Slovenian, the firmware list's "Current" column read "Tok" (an electric current). It is now "Installed" ("Nameščeno").
• A router whose internet comes over PPPoE now marks the port the connection runs through.
• With reduced motion turned on, a busy port's traffic LED no longer blinks.
• On a phone, card pages no longer spill past the edge of the window.
• At some window widths, Arrange and the page footer stood up to 19px past the edge of the cards. They now end where the cards do.

Upgrade

apk update && apk upgrade

Upgrade the plugins together with Verso. DNS & DHCP's sections no longer show a count in their headings, matching the core pages.

New on x86-64? Add the feed and install:

wget -O /etc/apk/keys/verso.pem https://sysupgrade.mono.si/verso/verso.pem
echo "https://sysupgrade.mono.si/verso/x86_64/packages.adb" > /etc/apk/repositories.d/verso.list
apk update && apk add verso

Feedback

Report bugs, suggestions and actionable feedback as GitHub Issues: https://github.com/we-are-mono/verso/issues

Verso 0.5.0

Verso 0.5.0

Verso is highly experimental. Back up your router's configuration before you upgrade.

New

• A new Overview. The home page is now seven cards in two columns: Internet, Ports, Tunnels, Traffic, Resources, Hardware and Firmware. Each card's header carries its status, and its arrow leads to the page behind it.
• Fold what you don't read. Click a card's header to close it. A closed card shows the one reading most worth a glance: your public address, the devices connected, the traffic now, memory, the CPU's temperature or the firmware.
• Arrange it your way. Arrange lets you move cards between the columns (drag them, or use the arrow keys on a card's handle) and hide the ones you never need. Reset layout brings back the default. A hidden card costs the router nothing.
• One sentence for the whole network. "Your network is online" turns into "needs attention" when anything does, a hidden card's problem included, and the card with the problem says what it is. The firewall has no card of its own: a firewall that isn't fully loaded shows up here.
• A calmer traffic graph. The Traffic card counts on a round scale (60 · 45 · 30 · 15) that moves only when your traffic crosses a step, with its values beside the plot instead of over it.
• Rates read one way everywhere. Mb/s, Gb/s from 1000, one decimal under ten and whole numbers above, written with your language's decimal separator (4,3 Mb/s in Slovenian). This covers the Overview, Devices, a port's link speed and uploads.
• x86-64. Verso now ships for x86-64 OpenWrt routers as well as arm64, each with its own signed feed.

Changes to your router

• The Overview's layout is kept in a cookie in each browser (verso_overview); nothing about it is stored on the router. Another browser starts from the default layout.
• /etc/verso is owned by root and readable by the verso group (0750); the init script restores this on every start.

Fixed

• On a fresh install, Verso could fail to start: verso-rpcd made /etc/verso readable by root only, so the web interface couldn't read its certificate.
• CPU temperature no longer reads "high" when the fan starts spinning faster (at 40 °C on the Gateway). The warning now starts where the CPU would be slowed down.
• A port that a network uses no longer reads as spare a second after the Overview loads, and a port that loses its link now reaches the status sentence.
• A spare port shows its link state like any other port.
• An upload's size and progress are shown in MiB in your language.

Upgrade

apk update && apk upgrade

Upgrade the plugins together with Verso. The QoS plugin now writes its limits in Mb/s; older versions of it keep working.

New on x86-64? Add the feed and install:

wget -O /etc/apk/keys/verso.pem https://sysupgrade.mono.si/verso/verso.pem
echo "https://sysupgrade.mono.si/verso/x86_64/packages.adb" > /etc/apk/repositories.d/verso.list
apk update && apk add verso

Feedback

Report bugs, suggestions and actionable feedback as GitHub Issues: https://github.com/we-are-mono/verso/issues

Verso 0.4.0

Verso 0.4.0

Verso is highly experimental. Back up your router's configuration before you upgrade.

New

• Every change, kept. System → Changes lists every apply, newest first by day, each named from what it touched: Allow-Ping target ACCEPT → DROP. A row opens on each option it changed, with what it held before and after.
• Undo, and go back. A change's drawer can undo it, stage a rolled-back change again, or return the router to how it was just after that change. Each only stages: nothing goes live until you apply it from the staged-changes chip, with the usual 30-second rollback. Undo warns you when a later change touched the same setting.
• Changes made outside Verso. An edit over SSH, by a script or by another tool shows up within seconds as "Edited directly", and can be undone like any other.
• A note on each apply. The staged-changes drawer has an optional note; it appears beside the change in its history.
• The internet's history. The Internet graph on the overview can show the last minute, 24 hours, 7 days, 30 days or the last year. Outages, restarts and packet loss are marked on it, with the gateway's average latency.
• Events. System → Events lists when the internet went down and came back, when the router started (and whether it lost power or crashed first), and when applied changes were rolled back.
• Alerts. The router posts an alert to an address of yours when the internet goes down and comes back, when it restarts after a crash, and when changes roll back. Alerts carry ntfy's headers, so ntfy shows them as they are, and any webhook can read them. A heartbeat address, called every five minutes, lets a monitor such as Healthchecks.io or Uptime Kuma tell you about an outage while it lasts. Set them up from System → Events → Alerts.
• Access warns you when the internet can reach the web interface.

Changes to your router

• Verso keeps the router's history in history.db: in /data/verso where /data exists, otherwise in /usr/share/verso/history. verso.history.directory chooses another place.
• Verso pings the uplink's gateway every ten seconds to measure latency and loss. It reaches nothing on the internet unless you list addresses in verso.history.probe.
• Config history keeps the last 1000 changes. Older ones fold into a starting point, which you can still return to. uci set verso.history.changes=5000 keeps more, if your storage allows.
• verso-rpcd watches /etc/config to see changes made outside Verso. Passwords and keys are never stored: history records only that they changed, using a fingerprint whose key, /etc/verso/fingerprint.key, only root can read.
• Factory reset now erases the router's history too (charts, events, changes and per-device usage on /data), unless you clear "Also erase the router's history".
• Don't downgrade below this release. Development builds made between 0.3.0 and 0.4.0 erase history kept by this one.

Fixed

• Times everywhere are shown in the router's time zone.
• Today's usage is right outside UTC.
• Devices: the Now column keeps its width, and a device's load is shown as light, medium or heavy for what its rate is enough for.
• A plugin installed over SSH shows up without restarting Verso or signing in again.

Upgrade

apk update && apk upgrade

Feedback

Report bugs, suggestions and actionable feedback as GitHub Issues: https://github.com/we-are-mono/verso/issues

Verso 0.3.0

Verso 0.3.0

Verso is highly experimental. Back up your router's configuration before you upgrade.

New

• Who is using the connection. Devices shows what each device is downloading and uploading right now, with a meter of its share of the line, and its total for this month. A device's panel adds a live traffic graph and its usage today, over the last 7 days, this month and last month.
• Dynamic DNS. A new non-core plugin, verso-plugin-ddns, keeps a name pointing at your router, through Cloudflare, DuckDNS, No-IP, deSEC, dynv6 or any provider's update URL. It needs this release.

Changes to your router

• verso now depends on nlbwmon, which counts traffic per device. Verso sets it to keep one total per day for thirteen months, on storage that survives a reboot (/data/nlbwmon where /data exists, otherwise /usr/share/nlbwmon/db), and it writes there once a day. If you chose your own directory, it stays. To turn usage off, disable nlbwmon on System → Services.
• Removing Verso leaves the router as it found it: uhttpd gets ports 80 and 443 back, every Verso service stops, and nlbwmon returns to its stock settings. Your settings and usage history stay.

Fixed

• Packages and Services no longer pause for seconds on the router.
• A package's panel finds the package by its exact name.
• A switch's explanation is translated in every plugin.

Upgrade

apk update && apk upgrade

To add Dynamic DNS:

apk add verso-plugin-ddns

Feedback

Report bugs, suggestions and actionable feedback as GitHub Issues: https://github.com/we-are-mono/verso/issues

Verso 0.2.0

Verso 0.2.0

Verso is highly experimental. Back up your router's configuration
before you install it, and before you change settings with it.

Verso is a web interface for OpenWrt. LuCI is built to fit the smallest
devices; Verso is built for routers with room to spare — 128 MB of flash or
more — and on those it replaces LuCI with one calm, consistent place to set
up and watch the router.

Verso is two kinds of program. The shell is the web server you reach in the
browser: it signs you in, draws the sidebar and every page, and keeps the
interface running. Plugins supply the pages themselves.

Almost every page in Verso is a plugin. A plugin runs as its own process and
describes its pages with a closed set of widgets, which the shell draws. A
plugin written by anyone looks like the rest of Verso, and a plugin that
crashes takes only its own page down.

Verso does not run as root. You sign in with the router's own accounts, and
every change goes through rpcd and its access lists, the same gate LuCI
uses. Changes are staged and applied together, and the router rolls them
back on its own if the browser stops answering afterwards.

Verso serves HTTPS itself, with a self-signed certificate made for the
router on first start. On a router where LuCI already holds the web ports,
Verso answers beside it on port 8443, and System → Access moves the router's
web address to Verso — or hands it back to LuCI — when you choose.

Core and non-core plugins

Core plugins ship inside the verso package. They cover what every router
needs, so they are always installed and always running, and their pages are
part of Verso out of the box:

• Interfaces — the router's network interfaces and routes
• Firewall — zones, traffic rules and port forwards
• System — the router's general settings, and its passwords, SSH keys and
  certificate on Access

The shell itself serves the Overview and the pages that manage the router as
a whole: packages, services, logs, diagnostics, hardware, and maintenance —
backups, firmware and updates.

Non-core plugins are packages of their own, installed only if you want them,
each developed in its own repository at github.com/we-are-mono/.
Each one adds its pages to the sidebar once installed and takes them away
when removed, and each depends on the OpenWrt service it manages:

• verso-plugin-dnsdhcp — DNS and DHCP: dnsmasq and odhcpd
• verso-plugin-qos — device limits: what a device may reach, when, and how fast
• verso-plugin-vpn — every tunnel on the router, and OpenVPN profiles

Core does not mean privileged. Core and non-core plugins run as separate
processes under the same rules, speak the same contract, and are bound by
the same access lists; a third-party plugin is written the same way.

Languages

Verso is fully internationalised and translatable. Every string the shell
and its plugins show is translatable; translations are plain JSON catalogs,
and each plugin carries its own, so a plugin arrives translated. Verso speaks
the language your browser asks for when a catalog for it is installed, and
English otherwise. A new language is a package installed with apk, with no
restart. Slovenian ships as verso-i18n-base-sl.

Requirements

• OpenWrt with apk: 25.12, or a snapshot. Releases that use opkg are not
  supported.
• An aarch64 router (aarch64_generic). This release is built for no other
  architecture for the time being.

Install

Back up the router's configuration first, and copy the archive off the
router:

sysupgrade -b /tmp/backup.tar.gz

Trust the feed's signing key and add the feed:

wget -O /etc/apk/keys/verso.pem https://sysupgrade.mono.si/verso/verso.pem
echo 'https://sysupgrade.mono.si/verso/aarch64_generic/packages.adb' \
  > /etc/apk/repositories.d/verso.list
apk update

Install Verso, and any plugins you want with it:

apk add verso
apk add verso-plugin-dnsdhcp verso-plugin-qos verso-plugin-vpn
apk add verso-i18n-base-sl

Then open the router in a browser:

• https://192.168.1.1/ when nothing else serves the web ports
• https://192.168.1.1:8443/ when LuCI is installed

Use your router's address if it is not 192.168.1.1. The browser warns about
the self-signed certificate once; accept it, and sign in as root with the
router's password.

Upgrade

apk update && apk upgrade

Next steps

• Let's Encrypt certificates. A new non-core plugin, verso-plugin-acme,
  will get a trusted certificate for a domain of your own through a DNS-01
  challenge, so the router needs no open port, and renew it on its own.
• Night mode. A dark theme for Verso, following the browser's setting.
• Wi-Fi. A non-core plugin for the router's wireless networks and
  radios, each network edited in place.
• WireGuard. A non-core plugin that adds devices to a WireGuard tunnel
  with a QR code to scan, in plain language rather than as a config editor.

Feedback

Report bugs, suggestions and actionable feedback as GitHub Issues:
https://github.com/we-are-mono/verso/issues