fix: web.status_content is basic by default.

ADR.md

@@ -44,9 +44,9 @@ address of the internal interface, of the external interface or of both, as `web
 unless `web.enabled` is `false` (ADR-7). `/` is for people, in plain text for `curl` and `wget`
 and as a Tailwind CSS page for a browser, and `/status` is the same status as JSON. Both show as
 much as `web.status_content` says, since the router is reachable from the internet and the
-operator decides how much it tells strangers: `basic` the overall status and the Client IP,
-`standard` also the package versions and the number of active and other services, and `full`,
-the default, also each service and the state of the site-to-site, road-warrior, OpenVPN and
+operator decides how much it tells strangers: `basic`, the default because it tells the least,
+the overall status and the Client IP, `standard` also the package versions and the number of
+active and other services, and `full` also each service and the state of the site-to-site, road-warrior, OpenVPN and
 WireGuard features. The Client IP is the address the request came from, through the trusted
 proxies, so a person can see the address the router sees. Nothing comes from the configuration.
 `/status` names its content, so clients such as manage-ui and the Router Manager show what it

README.md

@@ -128,7 +128,7 @@ must have the type shown below; an unknown section or setting is an error.
 | `web` | `port` | integer | `7081` | TCP port of the status web service |
 | `web` | `database` | string | | A PostgreSQL connection string for the refresh tokens; without it, the `vpn-router` database on this host that the web service creates |
 | `web` | `trusted_proxies` | list | the address the call came in on | Addresses whose `X-Forwarded-For` header names the client for the `/auth` rate limit and the Client IP of the status |
-| `web` | `status_content` | string | `full` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) |
+| `web` | `status_content` | string | `basic` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) |
 | `https` | `enabled` | boolean | `true` | Caddy serves the status web service and the Router Manager over HTTPS for `wan.local_fqdn` |
 | `https` | `email` | string | | The e-mail address of the Let's Encrypt account |
 | `https` | `web_port` | integer | `7444` | HTTPS port of the status web service |
@@ -506,9 +506,9 @@ configuration: no key, identity, subnet, or address but the client's. They show
 
 | `status_content` | `/` and `/status` show |
 |---|---|
-| `basic` | The overall status (`ok` or `degraded`), the time and the Client IP |
+| `basic` (default) | The overall status (`ok` or `degraded`), the time and the Client IP |
 | `standard` | Also the `vpn-router` version, the `vpn-router-manager` version or that it is not installed, and the number of active services and of services in any other state, without their names |
-| `full` (default) | Also each service and its state, Docker, and the state of site-to-site, road-warrior, OpenVPN and WireGuard |
+| `full` | Also each service and its state, Docker, and the state of site-to-site, road-warrior, OpenVPN and WireGuard |
 
 The Client IP is the address the request came from: the last entry of `X-Forwarded-For` for a
 request from one of `web.trusted_proxies`, by default the address the request came in on, so

debian-package/debian/changelog

@@ -1,3 +1,13 @@
+vpn-router (0.14.1-1) unstable; urgency=medium
+
+  fix: web.status_content is basic by default.
+
+  * Without web.status_content, or with a value that is not allowed, /
+    and /status show only the overall status, the time and the Client
+    IP; set it to standard or full to show more.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sun, 25 Oct 2026 17:00:00 +0200
+
 vpn-router (0.14.0-1) unstable; urgency=medium
 
   feature: the status page shows the Client IP, and web.status_content sets how much it shows.

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -55,7 +55,7 @@ SCHEMA = {
     'openvpn':    {'enabled': False, 'address_pool': '', 'port': 1194, 'protocol': 'udp'},
     'docker':     {'mode': 'auto', 'exposed_ports': []},
     'web':        {'enabled': True, 'listen': DEFAULT_LISTEN, 'port': 7081, 'database': '', 'trusted_proxies': [],
-                   'status_content': 'full'},
+                   'status_content': 'basic'},
     'https':      {'enabled': True, 'email': '', 'web_port': 7444, 'manager_port': 7443},
 }
 

debian-package/src/usr/lib/vpn-router/web

@@ -29,10 +29,10 @@ served (404) while the key does not exist. /auth is limited to AUTH_LIMIT calls
 address in AUTH_WINDOW seconds; the address of a call from one of web.trusted_proxies, by
 default the address the call came in on, is the last entry of its X-Forwarded-For header.
 
-/ and /status show only the status, as much as web.status_content says (see shown): basic the
-overall status, the time and the client's address (its address as for the rate limit below);
-standard also the package version, the installed version of vpn-router-manager (manager_version,
-null when it is not installed) and the number of active and other services; full, the default,
+/ and /status show only the status, as much as web.status_content says (see shown): basic, the
+default, the overall status, the time and the client's address (its address as for the rate limit
+below); standard also the package version, the installed version of vpn-router-manager
+(manager_version, null when it is not installed) and the number of active and other services; full
 whether each service runs, whether Docker is installed, and the state of site-to-site, road-warrior
 (IPsec P2S), OpenVPN and WireGuard. No configuration data or key is shown, and no address but the
 client's.
@@ -298,10 +298,10 @@ def shown(status, content, client):
     Every content has status, time and client_ip, the client's address, and content, which one it is: basic nothing
     more; standard adds version, manager_version and services, the number of active units and of units in every
     other state; full adds the whole status document of collect. Content that is not one of
-    vpnrouter.STATUS_CONTENTS is full.
+    vpnrouter.STATUS_CONTENTS, or not set, is basic.
     """
     if content not in vpnrouter.STATUS_CONTENTS:
-        content = 'full'
+        content = 'basic'
     if content == 'full':
         return {**status, 'content': content, 'client_ip': client}
     document = {'status': status['status'], 'content': content, 'time': status['time'], 'client_ip': client}

debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example

@@ -49,7 +49,7 @@
     "port": 7081,
     "database": "",
     "trusted_proxies": [],
-    "status_content": "full"
+    "status_content": "basic"
   },
   "https": {
     "enabled": true,