feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

debian-package/debian/vpn-router.vpn-router-web.service

@@ -15,7 +15,7 @@ NoNewPrivileges=yes
 ProtectSystem=strict
 RuntimeDirectory=vpn-router
 RuntimeDirectoryPreserve=yes
-ReadWritePaths=-/etc/vpn-router -/etc/swanctl/x509crl
+ReadWritePaths=-/etc/vpn-router -/etc/swanctl/x509crl -/etc/openvpn/server -/var/lib/vpn-router/pki-publish
 ProtectHome=yes
 PrivateTmp=yes