feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.

debian-package/debian/changelog

@@ -1,3 +1,26 @@
+vpn-router (0.13.0-1) unstable; urgency=medium
+
+  feature: Caddy serves the status page and the Router Manager over HTTPS with a certificate from Let's Encrypt.
+
+  * The package depends on caddy. While https.enabled is true, the
+    default, and wan.local_fqdn is set, vpn-router-setup writes
+    /etc/caddy/vpn-router.Caddyfile and runs Caddy, which serves the
+    status page on https.web_port (7444) and the Router Manager, when it
+    is installed, on https.manager_port (7443) for wan.local_fqdn, and
+    obtains the certificate from Let's Encrypt with the HTTP challenge.
+  * The package's drop-in for caddy.service makes Caddy read that file
+    and keeps it from starting before the file exists. The file belongs
+    to root and the group caddy, which Caddy runs as, with mode 0640.
+  * The firewall opens port 80 on the external interface and the HTTPS
+    ports on both interfaces while HTTPS is on.
+  * The web service also listens on 127.0.0.1, where Caddy calls it.
+  * docker.exposed_ports may not take port 80 or the HTTPS ports while
+    HTTPS is on.
+  * Removing the package stops and disables caddy; purging it removes
+    /etc/caddy/vpn-router.Caddyfile.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sun, 25 Oct 2026 15:00:00 +0200
+
 vpn-router (0.12.3-1) unstable; urgency=medium
 
   fix: the web service listens on the internal address, the external address or both.

debian-package/debian/control

@@ -28,7 +28,8 @@ Depends: ${misc:Depends},
          openvpn,
          openvpn-auth-ldap,
          iproute2,
-         systemd-resolved
+         systemd-resolved,
+         caddy
 Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
  Configures a Linux host or virtual machine as a VPN router: site-to-site
  IKEv2 IPSec (strongSwan swanctl), optional road-warrior access using EAP-TLS,

debian-package/debian/install

@@ -19,4 +19,5 @@ src/usr/lib/vpn-router/wait-for-libpq                 usr/lib/vpn-router/
 src/usr/lib/vpn-router/generate-config                usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_platforms/*.py       usr/lib/vpn-router/vpnrouter_platforms/
 src/usr/share/vpn-router/templates/*                  usr/share/vpn-router/templates/
+src/usr/lib/systemd/system/caddy.service.d/vpn-router.conf usr/lib/systemd/system/caddy.service.d/
 src/usr/share/doc/vpn-router/vpn-router.json.example  usr/share/doc/vpn-router/

debian-package/debian/postrm

@@ -11,10 +11,10 @@ strip_ufw_blocks() {
 
     tmp="$(mktemp)"
     awk '
-        /^# (IPSEC|WIREGUARD|OPENVPN|P2S DNS|WEB|BOOTSTRAP|MANAGER|ROUTER FORWARD|ROUTER NAT|ROUTER MSS) RULES START$/ {
+        /^# (IPSEC|WIREGUARD|OPENVPN|P2S DNS|WEB|BOOTSTRAP|MANAGER|HTTPS|ROUTER FORWARD|ROUTER NAT|ROUTER MSS) RULES START$/ {
             skip = 1; pending = 0; next
         }
-        /^# (IPSEC|WIREGUARD|OPENVPN|P2S DNS|WEB|BOOTSTRAP|MANAGER|ROUTER FORWARD|ROUTER NAT|ROUTER MSS) RULES END$/ {
+        /^# (IPSEC|WIREGUARD|OPENVPN|P2S DNS|WEB|BOOTSTRAP|MANAGER|HTTPS|ROUTER FORWARD|ROUTER NAT|ROUTER MSS) RULES END$/ {
             skip = 0; next
         }
         skip { next }
@@ -49,6 +49,7 @@ case "$1" in
               /etc/wireguard/wg0.conf \
               /etc/openvpn/server/vpn-router.conf \
               /etc/openvpn/server/vpn-router-ldap.conf \
+              /etc/caddy/vpn-router.Caddyfile \
               /etc/vpn-router/vpn-router.json \
               /etc/vpn-router/web.key \
               /var/lib/vpn-router/setup.done

debian-package/debian/prerm

@@ -11,10 +11,10 @@ case "$1" in
             swanctl --terminate --ike road-warrior >/dev/null 2>&1 || true
         fi
 
-        # This package enabled wg-quick@wg0 and openvpn-server@vpn-router, so
-        # it takes them down again. Use the debhelper wrappers rather than
-        # systemctl, so the script behaves on a machine without systemd.
-        for unit in wg-quick@wg0.service openvpn-server@vpn-router.service; do
+        # This package enabled wg-quick@wg0, openvpn-server@vpn-router and
+        # caddy, so it takes them down again. Use the debhelper wrappers rather
+        # than systemctl, so the script behaves on a machine without systemd.
+        for unit in wg-quick@wg0.service openvpn-server@vpn-router.service caddy.service; do
             if command -v deb-systemd-invoke >/dev/null 2>&1; then
                 deb-systemd-invoke stop "$unit" >/dev/null 2>&1 || true
             fi