feature: the web service gives Apple VPN profiles that set up IKEv2 road-warrior access on macOS, iOS and iPadOS.

README.md

@@ -776,6 +776,23 @@ the file.
 The certificate is also accepted by road-warrior (IKEv2 EAP-TLS) access, which checks
 certificates only, so `disable` does not affect it; `remove` revokes the certificate for both.
 
+### Apple VPN profile
+
+While `p2s.enabled` is `true` and `wan.local_fqdn` is set, `/users/<name>/apple-profile` and a
+user's own `/account/apple-profile` give an unsigned Apple configuration profile (`.mobileconfig`)
+that sets up road-warrior access in the built-in VPN client of macOS, iOS and iPadOS. It holds:
+
+- the P2S CA and the root CA, the root installed as a trusted root;
+- the user's certificate and key as a PKCS#12 encrypted with the password of the request, with
+  3DES and SHA-1, the only encryption Apple's clients read; the device asks for the password when
+  the profile is installed, and the router does not keep it;
+- an IKEv2 VPN to `wan.local_fqdn`, with the user name as the local identity, the certificate over
+  EAP-TLS, and AES-256, SHA2-256 and group 14 for IKE and ESP, as the router's road-warrior
+  connection takes them.
+
+The password is 8 to 128 characters. A user asking for the own profile also gives the current
+password and, when enrolled, a code.
+
 ### Console login and SSH
 
 A member of `admins` enrolled for TOTP may have console login: the Router Manager's Shell page
@@ -1181,6 +1198,7 @@ and answer bodies are JSON; a request body is at most 65536 bytes.
 | `POST /users/<name>/unlock` | | the user |
 | `DELETE /users/<name>` | | `{"name", "removed": true}` |
 | `GET /users/<name>/profile` | | `{"name", "profile"}`, the OpenVPN client profile |
+| `POST /users/<name>/apple-profile` | `{"password"}` | `{"name", "profile"}`, the Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) |
 | `POST /users/<name>/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
 | `PUT /users/<name>/otp` | `{"secret", "code"}` | the user, once the code matches the secret |
 | `DELETE /users/<name>/otp` | | the user |
@@ -1237,6 +1255,7 @@ router manages them, their display name and description included. A failure is o
 | `POST /account/passkeys` | `{"current_password", "current_code"}` | `{"id", "options"}`: a pending registration, valid 2 minutes, and the options of `navigator.credentials.create` in their JSON form |
 | `PUT /account/passkeys` | `{"id", "credential", "label"?}`, `credential` the browser's answer as its `toJSON()` gives it; `label` at most 64 characters, `Passkey` without one | the user |
 | `DELETE /account/passkeys/<id>` | | the user |
+| `POST /account/apple-profile` | `{"current_password", "current_code", "password"}` | `{"name", "profile"}`, the user's Apple configuration profile of IKEv2 road-warrior access (see Apple VPN profile) |
 
 `current_code` is needed only for a user enrolled for TOTP; removing a passkey needs neither. A wrong current password or code gets
 403 and counts as a failed login; slapd accepts each code once, so a code used to sign in is not