Defer configuration by default and manage vpn-router.conf with ucf

Add platform = none as the shipped default so installing the package
changes nothing on the machine until a platform is chosen. Add a mode
setting (manual/interfaces/auto) controlling how much of the network
configuration is supplied versus detected from the system. Manage
/etc/vpn-router/vpn-router.conf with ucf instead of writing it once,
so dpkg-reconfigure can safely reapply debconf answers without
clobbering local edits. Extend NAT/forward rules to all local subnets,
not just the first.

debian-package/debian/templates

@@ -1,34 +1,62 @@
 Template: vpn-router/platform
 Type: select
-Choices: generic, azure, gcp
-Default: generic
-Description: Platform module
- Platform-specific additions to load. The router works without any of them;
- a module only adds what makes sense on its platform, such as the platform
- DNS resolver for road-warrior clients.
+Choices: none, generic, azure, gcp
+Default: none
+Description: Platform:
+ Which platform this router runs on. The choice loads platform-specific
+ additions, such as the provider DNS resolver for road-warrior clients.
+ .
+ none defers configuration entirely: the package installs its files and
+ changes nothing on the machine. Choose it when the router will be configured
+ later by hand or by a configuration-management tool, then set the platform in
+ /etc/vpn-router/vpn-router.conf when you are ready.
+ .
+ generic configures the router with no platform-specific additions.
+
+Template: vpn-router/mode
+Type: select
+Choices: manual, interfaces, auto
+Default: manual
+Description: Network configuration source:
+ How much of the network configuration you are supplying, and therefore how
+ much the package works out for itself:
+ .
+ manual - you give the interface names, the internal address and the internal
+ gateway. Nothing is detected.
+ .
+ interfaces - you give the two interface names. The internal address and
+ gateway are read from them.
+ .
+ auto - you give nothing. The interfaces are identified from the routing
+ table and their addresses read from the system. Convenient, but it can pick
+ the wrong interface and configure the machine incorrectly.
 
 Template: vpn-router/external_interface
 Type: string
 Default:
-Description: External network interface
+Description: External network interface:
  Name of the interface facing the untrusted network, for example eth0 or
  ens4. The addresses strongSwan binds on are read from it, so they are never
  configured separately.
- .
- Leave empty to configure the router later by editing
- /etc/vpn-router/vpn-router.conf.
 
 Template: vpn-router/internal_interface
 Type: string
 Default:
-Description: Internal network interface
+Description: Internal network interface:
  Name of the interface facing the protected network, for example eth1 or
  ens5. Routes for the local subnets are applied to it.
 
+Template: vpn-router/int_addr
+Type: string
+Default:
+Description: Internal interface address:
+ This host's own address on the internal network. Asked only in manual mode;
+ in the other modes it is read from the internal interface.
+
 Template: vpn-router/local_fqdn
 Type: string
 Default:
-Description: Local router FQDN
+Description: Local router FQDN:
  Fully-qualified domain name of this router (for example
  router.example.com). Used as the road-warrior server identity and
  certificate common name.
@@ -37,7 +65,7 @@ Template: vpn-router/local_id_mode
 Type: select
 Choices: fqdn, public_ip, internal_ip
 Default: fqdn
-Description: IKE local identity mode
+Description: IKE local identity mode:
  How to derive the IKE identity advertised to the remote site:
  .
  fqdn - use the FQDN, which must match what the peer expects.
@@ -49,40 +77,41 @@ Description: IKE local identity mode
 Template: vpn-router/local_cidrs
 Type: string
 Default:
-Description: Local subnet CIDR(s)
+Description: Local subnet CIDR(s):
  Comma-separated list of local subnet CIDRs to advertise into the
  site-to-site tunnel (for example 10.0.0.0/24 or 10.0.0.0/24,10.0.1.0/24).
 
 Template: vpn-router/int_gateway_ip
 Type: string
 Default:
-Description: Internal network gateway IP
+Description: Internal network gateway address:
  Address of the next-hop gateway on the internal side, used to route the
- local subnets listed above.
+ local subnets listed above. Asked only in manual mode; in the other modes it
+ is derived from the internal interface.
 
 Template: vpn-router/remote_addrs
 Type: string
 Default:
-Description: Remote site WAN IP address(es)
+Description: Remote site WAN IP address(es):
  Comma-separated list of remote gateway addresses or FQDNs for the
  site-to-site IPSec tunnel.
 
 Template: vpn-router/remote_id
 Type: string
 Default:
-Description: Remote site IKE identity
+Description: Remote site IKE identity:
  IKE identity of the remote peer, without a leading @.
 
 Template: vpn-router/remote_cidrs
 Type: string
 Default:
-Description: Remote subnet CIDR(s)
+Description: Remote subnet CIDR(s):
  Comma-separated list of remote subnet CIDRs reachable through the
  site-to-site tunnel (for example 192.168.0.0/24).
 
 Template: vpn-router/psk
 Type: password
-Description: Pre-shared key (PSK)
+Description: Pre-shared key (PSK):
  Pre-shared key for the site-to-site IKEv2 tunnel. Must match the value
  configured on the remote peer. Stored base64-encoded in the configuration
  file and cleared from the debconf database after installation.
@@ -98,13 +127,13 @@ Description: Enable road-warrior (P2S) access?
 Template: vpn-router/p2s_address_pool
 Type: string
 Default:
-Description: Road-warrior address pool
+Description: Road-warrior address pool:
  CIDR block assigned to road-warrior clients (for example 172.16.0.0/24).
 
 Template: vpn-router/p2s_ca_name
 Type: string
 Default: VPN Router CA
-Description: Road-warrior CA name
+Description: Road-warrior CA name:
  Common name for the certificate authority created in /etc/vpn-router/pki
  when that directory is empty. Ignored when certificates are supplied.
 
@@ -119,12 +148,12 @@ Description: Enable WireGuard?
 Template: vpn-router/wg_address
 Type: string
 Default:
-Description: WireGuard interface address
+Description: WireGuard interface address:
  Address and prefix length for the wg0 interface (for example
  192.168.200.1/24).
 
 Template: vpn-router/wg_listen_port
 Type: string
 Default: 51820
-Description: WireGuard listen port
+Description: WireGuard listen port:
  UDP port that WireGuard listens on.