feature: the web service creates its key and database itself and shows its starting phase.

README.md

@@ -125,7 +125,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `docker` | `exposed_ports` | list | | TCP ports and port ranges (`8000:8100`) reachable from the external interface; at most 15, a range counting as two |
 | `web` | `enabled` | boolean | `true` | The status web service on the internal address |
 | `web` | `port` | integer | `7081` | TCP port of the status web service |
-| `web` | `database` | string | | A PostgreSQL connection string for the refresh tokens; without it, the `vpn-router` database on this host that `vpn-router-setup` creates |
+| `web` | `database` | string | | A PostgreSQL connection string for the refresh tokens; without it, the `vpn-router` database on this host that the web service creates |
 | `web` | `trusted_proxies` | list | the listening address | Addresses whose `X-Forwarded-For` header names the client for the `/auth` rate limit |
 
 A minimal site-to-site configuration in `auto` mode:
@@ -473,6 +473,23 @@ The `vpn-router-web` service shows the state of the router on its internal addre
 `web.port` (7081 by default). Its pages `/` and `/status` need no authentication and show no
 configuration: no key, identity, address or subnet.
 
+The service starts in a starting phase: it makes its signing key and the refresh tokens'
+database, retrying every 15 seconds, for example while PostgreSQL is not running yet. Until that
+succeeds, `/` and `/status` show only the phase and its failure, with the state, the current step
+and the failure of the last run of `vpn-router-setup` (from `/run/vpn-router/setup.json`, which
+setup writes at every step), and every page answers 503 with `Retry-After`; then the pages below
+are served.
+
+```text
+VPN Router
+Status: starting
+
+Web service: creating the token database
+Web service failure: creating the token database failed: psql failed: ..., retrying every 15 s
+Setup: failed, step firewall, at 2026-10-25T02:00:00+0200
+Setup failure: vpn-router: error: /etc/ufw/before.rules does not exist
+```
+
 | Page | Content |
 | --- | --- |
 | `/` | The status for people: plain text for `curl` and `wget`, a page styled with Tailwind CSS for a browser, in the browser's light or dark scheme, that reloads itself every minute (the style sheet is loaded from a CDN, so the browser needs internet access; the text is readable without it) |
@@ -500,7 +517,7 @@ curl http://10.0.0.4:7081/status
 ### Tokens and signing in
 
 `/config`, `/users` and `/groups` need a JWT in an `Authorization: Bearer` header, signed with
-HS256 by the key `vpn-router-setup` makes on the router, `/etc/vpn-router/web.key` (root only).
+HS256 by the key the web service makes on its first run, `/etc/vpn-router/web.key` (root only).
 The key never leaves the router; while it does not exist these paths and `/auth` are not served
 (404). A missing, expired or wrongly signed token, or one of another algorithm, gets 401 with
 `WWW-Authenticate: Bearer`. There are two kinds of tokens:
@@ -539,7 +556,7 @@ default the address the service listens on, the client address is the last entry
 `X-Forwarded-For`.
 
 Refresh tokens are kept, as their SHA-256, in PostgreSQL: by default in the database and role
-`vpn-router` on the router, which `vpn-router-setup` creates with a password in
+`vpn-router` on the router, which the web service creates on its first run with a password in
 `/etc/vpn-router/database.secret` (root only), reached over TCP on `localhost`; `web.database`
 names another database. Tokens and passwords travel over plain HTTP on the internal network.