feature: Added an internally only exposed status web service.

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -48,8 +48,12 @@ SCHEMA = {
     'p2s':        {'enabled': False, 'address_pool': '', 'ca_name': 'VPN Router CA'},
     'wireguard':  {'enabled': False, 'address': '', 'listen_port': 51820},
     'docker':     {'mode': 'auto', 'exposed_ports': []},
+    'web':        {'enabled': True, 'port': 8080, 'jwt_secret': ''},
 }
 
+#: The shortest secret that signs the tokens of the status web service.
+WEB_SECRET_MIN = 32
+
 DOCKER_MODES = ('auto', 'on', 'off')
 
 #: A port or a port range as iptables multiport takes it: 443 or 8000:8100.
@@ -228,6 +232,14 @@ def validate(cfg):
     if not 1 <= port <= 65535:
         raise ConfigError(f'wireguard.listen_port: {port} is not a valid port')
 
+    web_port = _get(cfg, 'web', 'port')
+    if isinstance(web_port, bool) or not isinstance(web_port, int) or not 1 <= web_port <= 65535:
+        raise ConfigError(f'web.port: {web_port!r} is not a valid port')
+
+    web_secret = _get(cfg, 'web', 'jwt_secret')
+    if web_secret and len(web_secret) < WEB_SECRET_MIN:
+        raise ConfigError(f'web.jwt_secret: use at least {WEB_SECRET_MIN} characters')
+
     docker_mode = _get(cfg, 'docker', 'mode')
     if docker_mode not in DOCKER_MODES:
         raise ConfigError(
@@ -465,6 +477,8 @@ def build_context(cfg, local_id_override=None):
         'wg_enabled':      _get(cfg, 'wireguard', 'enabled'),
         'wg_address':      _get(cfg, 'wireguard', 'address'),
         'wg_listen_port':  _get(cfg, 'wireguard', 'listen_port'),
+        'web_enabled':     _get(cfg, 'web', 'enabled'),
+        'web_port':        _get(cfg, 'web', 'port'),
     }