feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

debian-package/debian/postrm

@@ -57,7 +57,9 @@ case "$1" in
               /var/lib/vpn-router/setup.done \
               /var/lib/vpn-router/backup.json
         rmdir --ignore-fail-on-non-empty /etc/systemd/system/vpn-router-backup.timer.d 2>/dev/null || true
-        rm -rf /var/lib/vpn-router/backup/staging /var/lib/vpn-router/backup/restore
+        rm -rf /var/lib/vpn-router/backup/staging /var/lib/vpn-router/backup/restore \
+               /var/lib/vpn-router/pki-publish /etc/caddy/vpn-router-pki \
+               /etc/openvpn/server/vpn-router-ca.pem /etc/openvpn/server/vpn-router-crl.pem
         rmdir --ignore-fail-on-non-empty /var/lib/vpn-router/backup /var/lib/vpn-router 2>/dev/null || true
 
         # The refresh tokens' database and role, when the package created them.
@@ -70,7 +72,9 @@ case "$1" in
         # Key material and users are not package state: /etc/vpn-router/pki,
         # /etc/vpn-router/ldap, /etc/vpn-router/rclone.conf, the user directory
         # in slapd, the WireGuard key pair, everything under /etc/swanctl, the
-        # backups and what a restore replaced are left in place.
+        # backups and what a restore replaced are left in place. Caddy stays
+        # installed, so its repository, which vpn-router-caddy configures, stays
+        # too.
         rmdir --ignore-fail-on-non-empty /etc/vpn-router 2>/dev/null || true
         ;;
 esac