feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example

@@ -22,14 +22,23 @@
       "cidrs": ["192.168.0.0/24"],
       "local_cidrs": ["10.0.0.0/24"],
       "local_id_mode": "fqdn",
+      "auth": "psk",
       "psk": "change-me",
-      "psk_file": ""
+      "psk_file": "",
+      "remote_ca": ""
+    },
+    "branch": {
+      "addrs": ["branch.example.org"],
+      "id": "branch.example.org",
+      "cidrs": ["192.168.10.0/24"],
+      "local_cidrs": ["10.0.0.0/24"],
+      "local_id_mode": "fqdn",
+      "auth": "certificate"
     }
   },
   "p2s": {
     "enabled": false,
-    "address_pool": "172.16.0.0/24",
-    "ca_name": "VPN Router CA"
+    "address_pool": "172.16.0.0/24"
   },
   "wireguard": {
     "enabled": false,
@@ -58,7 +67,31 @@
     "enabled": true,
     "email": "",
     "web_port": 7444,
-    "manager_port": 7443
+    "manager_port": 7443,
+    "caddy_source": "ubuntu"
+  },
+  "pki": {
+    "root_name": "VPN Router Root CA",
+    "root_days": 7300,
+    "ca_days": 3650,
+    "key": "rsa-4096",
+    "crl_days": 7,
+    "root_crl_days": 180,
+    "publish": ["http"],
+    "p2s_name": "VPN Router P2S CA",
+    "s2s_name": "VPN Router Site-to-Site CA",
+    "issuing_cas": {
+      "servers": {
+        "name": "VPN Router Server CA",
+        "templates": ["server"],
+        "acme": false
+      }
+    },
+    "templates": {
+      "server": {
+        "days": 397
+      }
+    }
   },
   "metrics": {
     "enabled": true,