feature: users can be enrolled for TOTP one-time passwords.

debian-package/debian/changelog

@@ -1,3 +1,19 @@
+vpn-router (0.6.0-1) unstable; urgency=medium
+
+  feature: users can be enrolled for TOTP one-time passwords.
+
+  * vpn-router-user otp-new makes a TOTP secret and its otpauth URI,
+    otp-enrol stores the secret, read from standard input, given a code of
+    it, and otp-remove removes it. list and every answer show whether a user
+    is enrolled, as otp.
+  * The web service enrols with POST, PUT and DELETE /users/<name>/otp.
+  * The secret is kept in the user's entry with the OATH-LDAP schema of
+    slapd's otp module; only the user manager account may set it, and no
+    one can read it. Logins do not ask for the codes.
+  * The package depends on python3-pyotp.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 23:30:00 +0200
+
 vpn-router (0.5.9-1) unstable; urgency=medium
 
   fix: package upgrades no longer ask the configuration questions.

debian-package/debian/control

@@ -21,6 +21,7 @@ Depends: ${misc:Depends},
          python3,
          python3-jinja2,
          python3-ldap,
+         python3-pyotp,
          slapd,
          openvpn,
          openvpn-auth-ldap,