feature: users and their certificates no longer need a P2S system enabled.

ADR.md

@@ -215,3 +215,20 @@ reaches the browser. The application checks the shape of every answer of the rou
 reaches the manager's port manages the router, so on another system it listens on `127.0.0.1`
 unless told otherwise. The router's firewall depends on whether the manager is installed, and a
 changed manager port needs `vpn-router-setup` to run again.
+
+## ADR-10: Users and their certificates do not depend on a P2S system being enabled
+
+Status: Accepted
+
+Context: The user directory and the CA were provisioned, and `/users` was served, only while
+OpenVPN or road-warrior access was enabled. Users could not be prepared before a P2S system was
+switched on, and the Router Manager could not manage them on a router without one.
+
+Decision: Once a platform is chosen, `vpn-router-setup` always provisions the user directory in
+slapd and the CA with its CRL; the server certificate follows once `wan.local_fqdn` is set.
+`/users` and `vpn-router-user` rely only on the directory and the CA. Only the OpenVPN client
+profile needs OpenVPN to be enabled.
+
+Consequences: slapd always holds the directory and the CA always exists on a configured router,
+even when no P2S system uses them. An operator who wants a CA of their own must place it before
+choosing the platform.