feature: users and their certificates no longer need a P2S system enabled.

README.md

@@ -272,12 +272,12 @@ ca_cert.pem  ca_key.pem  ca_bundle.pem  <label>_cert.pem  <label>_key.pem  crl.p
 `<label>` is the first component of the router FQDN, so `router.example.com` gives
 `router_cert.pem`.
 
-If road-warrior or OpenVPN access is enabled and this directory is empty, a certificate
-authority, a server certificate and a CRL valid for ten years are created there
-automatically; a CA without a CRL gets one. User certificates are issued by
-`vpn-router-user` into `users/`. To use your own instead, place the
-files in that layout before enabling the feature; nothing is generated or overwritten when
-material is already present.
+Once a platform is chosen and while this directory is empty, a certificate authority and a CRL
+valid for ten years are created there automatically, whether or not road-warrior or OpenVPN
+access is enabled. A CA of the router's own (with `ca_key.pem`) without a CRL gets one, and
+without a server certificate gets one once `wan.local_fqdn` is set. User certificates are issued
+by `vpn-router-user` into `users/`. To use your own CA instead, place the files in that layout
+before choosing the platform; nothing present is overwritten.
 
 Either way, the package copies what each consumer needs into place: the CA into
 `/etc/swanctl/x509ca/`, the server certificate and key into `/etc/swanctl/x509/` and
@@ -314,8 +314,9 @@ certificate names:
 
 ### The user directory
 
-While OpenVPN or road-warrior access is configured, `vpn-router-setup` keeps a directory of
-users in the local slapd:
+Once a platform is chosen, `vpn-router-setup` keeps a directory of users in the local slapd,
+whether or not OpenVPN or road-warrior access is enabled, so users can be managed before either
+is switched on:
 
 - its own database, `dc=vpn-router,dc=local` in `/var/lib/ldap/vpn-router`, next to the one the
   slapd package creates; root manages it through the local socket, with no administrator
@@ -328,7 +329,7 @@ users in the local slapd:
   (`pwdAccountLockedTime`);
 - slapd listens on its local socket only (`SLAPD_SERVICES` in `/etc/default/slapd`).
 
-The directory is kept when OpenVPN and road-warrior access are switched off, and on purge.
+The directory is kept on purge.
 
 ### Managing users
 
@@ -484,8 +485,8 @@ and answer bodies are JSON; a request body is at most 4096 bytes.
 | `GET /users/<name>/profile` | | `{"name", "profile"}`, the OpenVPN client profile |
 
 A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not
-exist, 409 for a user that exists and 500 otherwise. While neither OpenVPN nor road-warrior
-access is configured, `/users` answers 404. Passwords and private keys cross the internal
+exist, 409 for a user that exists and 500 otherwise. `/users` works whether or not OpenVPN or
+road-warrior access is enabled; the profile needs OpenVPN. Passwords and private keys cross the internal
 network in plain HTTP, like the token.
 
 ```bash