Can confirm, short term testing worked.

100% agree. I have submitted a similar feature request here:

Although, now that I look at the contents of the 'zz' country code, I wonder if there are unintended consequences to specifying some of these... Such as the multicast ones, etc.

https://github.com/vyos/vyos-1x/pull/2495

Fix was merged into 1.4 and 1.5.

This is still an issue in 1.5. I tried importing a cert signed by my own CA and got the same error.

https://github.com/vyos/vyos-1x/pull/2486

The country-code item in the config_dict is type list and gets skipped by the convert_to_set_commands function.

What about using nginx which seems to be already leveraged by the web API?

Here is another candidate, although msmtp still looks like a better choice:
https://wiki.debian.org/nullmailer

According to firewall-version.xml.i, the firewall config version was not updated to 12. Was this intentional?

I understand (and accept) the risks of running rolling.

When moving from vyos-1.5-rolling-202310090023 to vyos-1.5-rolling-202311020022 all of my inbound-interfaces got dropped from my firewall config. The NAT ones got migrated successfully.

This has been implemented in 1.5 and 1.4.

This functionality has also been backported to 1.4 so it will be in the next LTS release.

@fsbof This change was accepted so it should end up in the 1.5 rolling soon. I suspect backporting to 1.4 wouldn't be an issue but that is a question for a more senior dev. But as for 1.3, I am unsure as I have never ran that version and don't know if there are any changes between those releases that would make it a pain to backport.

Once accepted, I will update the documentation for this change as well as the ssh fingerprint change (T5653).

https://github.com/vyos/vyos-1x/pull/2369

I've updated this to default to no ASCII art as I think it's cleaner, but added an option to show it if you want to see it:

I had a similar issue going from 1.5-rolling-202309250022 to 1.5-rolling-202310090023.

An additional "nice to have" would be a hook that runs on route state change.
Examples:

set protocols failover route 0.0.0.0/0 next-hop 100.100.100.1 hook '/config/scripts/failover-hook-100.100.100.1'

https://github.com/vyos/vyos-1x/pull/2323

Also added flowtable as nothing needs to be sequenced in there either:
https://github.com/JeffWDH/vyos-1x/commit/ac22cc054d9c15af010c824ac9a05f5cc71fc954

I have not contributed code to this project before so let me know if I've missed conventions...

Is there a reason why some global options and some address groups (not all) are included in the output? Seems unintentional to me.