We haven't seen memory leaks in keepalived in a long time, so I assume it's resolved.

Now that 1.3 is near a stable release, it's a good idea to revisit the hardening measures and see if we can enable any new ones.

I can confirm that NAT logging works fine in 1.2.7. So if there was a bug related to it, it's been long fixed.

This is still reproducible in the FRR master branch, so I've filed an issue: https://github.com/FRRouting/frr/issues/8695

Sadly, two years later, OMAPI is still unsuitable for this purpose.

Is there a specific reason not to put it in vyos-1x instead?

Sadly, this isn't a trivial update due to dependencies. However, Microsoft's own documentation says the version that is unsupported for real is 2.2.10, and 2.20 is still supported, even if they recommend the very latest one.

This is a config syntax design mistake on our side indeed. The "preference" option should have always been under "cache".

I agree we should just check if it starts with a letter and doesn't include characters that an FQDN cannot have.

Well, they do work together.

The preliminary idea is to use load-balancing inbound syntax for balancing load between multiple hosts inside the network (i.e. LVS) and load-balancing outbound for balancing connections between multiple WAN interfaces.

Yes, but since it won't solve the notification problem, these are separate concerns. Let's make a new task for migrating that script from atd to systems for scheduling reboots.

I think we can make it a systemd service that is started on commit-confirm and stopped on confirm.

No one complained in a long time. ;)
If it re-appears, feel free to reopen. We also need to find a platform that knowingly does IKEv1 lifetime negotiation for testing this.