update: the router web service is split into the package vpnrouter_web, with one module per family of paths.

ADR.md

@@ -1253,3 +1253,28 @@ changed since. Files open only while their shell lives.
 Consequences: The editor edits only what the console account may; a file only root may write is
 edited in the terminal. `vre` run under sudo is refused, as its uid is not the console account's.
 Each read and save starts a transient unit. Files are limited to 1 MiB of UTF-8 text.
+
+## ADR-47: The web service is the package vpnrouter_web, with one module per family of paths
+
+Status: Accepted
+
+Context: The web service answers about twenty families of paths: the status, the sign-in, the
+identities, the connections, backups, the PKI, logs, web sites, DNS, metrics and the shell with
+its editor. Kept in one script, the code of unrelated paths is read and changed together.
+
+Decision: `/usr/lib/vpn-router/web` only initializes and serves. The package
+`/usr/lib/vpn-router/vpnrouter_web/` holds the rest, laid out next to `vpnrouter_platforms/`:
+
+- `handler`: the `Handler` class, which reads a request, checks its token and routes it.
+- One module per family of paths (`status`, `auth`, `identities`, `connectivity`, `backup`, `pki`,
+  `logs`, `sites`, `dns`, `metrics`, `shell`), each with its constants and state.
+- `common`: what several of them need.
+
+A module imports from `common` and from no other route module, except `auth`, which takes the
+paths of a site's files from `sites`. `handler` imports them all, so the imports have no cycle. A
+function that needs the request takes the `Handler` as its first parameter instead of being a
+method.
+
+Consequences: A change to one family of paths touches one module and the routing in `handler`.
+State shared between requests, such as the open shells, lives in the module that owns it; other
+modules change it and never rebind it.