fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -7,10 +7,10 @@ common name, which OpenVPN and IKEv2 accept. A Manager-only account is an accoun
 simpleSecurityObject and vpnRouterAccount (the package's schema) with a name, a password and
 optionally an e-mail address, no names, no certificate and so no VPN access; it is added when
 neither the first nor the last name is given, and can sign in to the web service. A service
-account is a Manager-only account with the scope SERVICE_SCOPE in vpnRouterScope, which cannot
-sign in to the web service; an administrator adds one for a service that checks passwords
-against the directory. The internal one is the account metrics.service_account names while
-metrics are enabled, which vpn-router-setup adds and whose password it keeps (metrics_account).
+account is a Manager-only account with the scope SERVICE_SCOPE in vpnRouterScope, which another
+system signs in with to use a router service, and which cannot sign in to the web service. The
+internal service accounts are those the router creates and manages for its own services
+(internal_accounts); vpn-router-setup keeps the metrics service's.
 Users exist whether or not a P2S system is enabled.
 
 A group is a groupOfNames in ou=groups with a name, which follows the rules of user names, an
@@ -194,19 +194,20 @@ def service(attributes):
     return SERVICE_SCOPE.encode() in (value.lower() for value in attributes.get('vpnRouterScope', []))
 
 
-def metrics_account():
-    """The internal service account: the one metrics.service_account names while metrics are enabled, else None."""
+def internal_accounts():
+    """The names of the internal service accounts, which the router creates and manages for its own services: the one
+    metrics.service_account names while metrics are enabled."""
     try:
         metrics = vpnrouter.load_config()['metrics']
     except SystemExit:
-        return None
-    return metrics['service_account'] if metrics['enabled'] else None
+        return set()
+    return {metrics['service_account']} if metrics['enabled'] else set()
 
 
 def summary(attributes):
     """A user as the answers show it; a person attribute the entry does not have is None.
 
-    internal is whether it is the internal service account (metrics_account).
+    internal is whether it is an internal service account (internal_accounts).
     """
     name = attributes['uid'][0].decode()
     lock = attributes.get('pwdAccountLockedTime', [None])[0]
@@ -214,7 +215,7 @@ def summary(attributes):
         'name': name,
         'manager_only': manager_only(attributes),
         'service': service(attributes),
-        'internal': service(attributes) and name == metrics_account(),
+        'internal': service(attributes) and name in internal_accounts(),
         'enabled': lock != LOCKED,
         'locked': lock not in (None, LOCKED) and locked_since(lock) > time.time() - vpnrouter_ldap.LOCKOUT_SECONDS,
         'certificate': certificate(name)[0].is_file(),