feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.

examples/install.sh

@@ -26,7 +26,7 @@ REMOTE_CIDRS="${REMOTE_CIDRS:-[\"192.168.0.0/24\"]}"
 PSK="${PSK:-change-me}"
 P2S_ENABLED="${P2S_ENABLED:-false}"
 P2S_ADDRESS_POOL="${P2S_ADDRESS_POOL:-172.16.0.0/24}"
-P2S_CA_NAME="${P2S_CA_NAME:-VPN Router CA}"
+PKI_ROOT_NAME="${PKI_ROOT_NAME:-VPN Router Root CA}"
 WG_ENABLED="${WG_ENABLED:-false}"
 WG_ADDRESS="${WG_ADDRESS:-}"
 WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"
@@ -66,8 +66,10 @@ cat > /etc/vpn-router/vpn-router.json <<EOF
   },
   "p2s": {
     "enabled": ${P2S_ENABLED},
-    "address_pool": "${P2S_ADDRESS_POOL}",
-    "ca_name": "${P2S_CA_NAME}"
+    "address_pool": "${P2S_ADDRESS_POOL}"
+  },
+  "pki": {
+    "root_name": "${PKI_ROOT_NAME}"
   },
   "wireguard": {
     "enabled": ${WG_ENABLED},