feature: the package installs the Router Manager, which is no longer a package of its own.

docs/account.md

@@ -0,0 +1,30 @@
+# Account
+
+Your own account: your name, kind, names, e-mail address, whether you are an administrator and
+whether you are enrolled for one-time passwords. The Account and the Passkeys panel are side by
+side, with One-time passwords and, for VPN users, VPN profiles below them.
+
+## Actions
+
+Each change but removing a passkey asks for your current password and, when you are enrolled, a
+code not already used to sign in.
+
+- **Change password** (Account panel): opens a dialog for the current and the new password; the
+  change signs you out.
+- **Enrol** or **replace** an authenticator app: scan the QR code, then enter a code of the app.
+  Removing the enrolment is left to an administrator.
+- **Add a passkey:** the browser or your password manager creates a passkey for the router's name;
+  each passkey has a label and the time it was added, and a remove icon.
+- **VPN profiles** (VPN users), each after your current password and, when enrolled, a code:
+  - **Download the OpenVPN profile:** a `.ovpn` file for an OpenVPN client, which signs in with
+    your name and password.
+  - **Download the Apple VPN profile (IKEv2):** a `.mobileconfig` that sets up the router's IKEv2
+    VPN on a Mac, iPhone or iPad. It also asks for a profile password, which the device asks for
+    when you install the profile in System Settings (Mac) or Settings (iPhone, iPad).
+
+## Passkeys
+
+**Sign in with a passkey** on the sign-in page uses a passkey the browser offers, without the
+name, the password or the code. Passkeys work on the Manager's HTTPS address on the router's name
+only. They sign in to the Manager and to the router's OpenID Provider, and open a shell on the
+[Shell](shell.md) page in place of the password and code.

docs/backup.md

@@ -0,0 +1,25 @@
+# Backup
+
+The router's backups: to a local folder, copied to the cloud with rclone, or to a Proxmox Backup
+Server.
+
+## Sections
+
+- **Settings:** whether scheduled backups run, the schedule (hourly, daily or weekly), the target
+  and whether the metrics database is included. A local folder also shows the folder, the archives
+  kept and the cloud copy; a Proxmox Backup Server the repository, whether the token secret is
+  set, the fingerprint, the namespace and the encryption key file.
+- **Last run:** its result, times, archive or snapshot, size, cloud copy and error, and the next
+  run.
+- **Local archives:** with their times and sizes, searched by name and time, 10, 25, 50 or 100 at
+  a time.
+- **Warnings:** the PBS client or rclone the settings need is not installed on the router.
+
+## Actions
+
+- **Edit:** changes the settings in one dialog. Only the retention settings that apply to the
+  schedule are offered. The rclone remote is one of the router's `/etc/vpn-router/rclone.conf`,
+  with a path and the mode, sync or copy. The token secret is kept when left empty.
+- **Run now:** starts a backup; the tab reads every 3 seconds until it ends.
+
+Restoring is done on the router as root with `vpn-router-backup restore`.

docs/certificates.md

@@ -0,0 +1,30 @@
+# Certificates
+
+The router's two-level CA: a root CA and issuing CAs that sign the certificates.
+
+## Above the tabs
+
+- **Issue:** a certificate from a CSR, saved with its chain, or with a key the router makes, saved
+  as a PFX file protected by a password; the router keeps no copy of the key.
+- **Settings:** the names, lifetimes, key type, CRL validity and publishing endpoints.
+- **Warnings:** what needs attention, such as a CRL about to expire.
+
+## Tabs
+
+- **Root:** the root CA's subject and expiry, whether its key is on the router (marked with a
+  warning sign) or offline, and its CRL. **Download root CA** gives its certificate; **Upload CRL**
+  takes a root CRL signed offline. Below, the certificates of the issuing CAs.
+- **Templates:** key, lifetime, subject, usages, alternative names, certificate policies and the
+  CAs that issue each template. **Add template**, **Edit**, **Remove** for the router's own and
+  **Reset** for a changed built-in one.
+- **Extended key usages:** the usages templates may give, with their OIDs; custom ones are added
+  with a name and an OID.
+- **P2S Issuing CA** and **S2S Issuing CA:** the CAs of the VPN users and of site-to-site
+  connections. An active CA gives its CA bundle; a pending CA, waiting for the offline root, gives
+  its CSR and takes the certificate the root signed.
+- **Issuing CAs:** general-purpose CAs, each with its templates and an optional ACME server.
+  **Add issuing CA**, **Edit** and **Remove**; a removed CA is retired and its certificate revoked.
+- **Certificates:** each with its kind, template, names, expiry and state; one of another system
+  or of the router is revoked after a confirmation with a reason.
+
+The root key is exported, removed and imported on the router with `vpn-router-ca`, never here.

docs/dns.md

@@ -0,0 +1,56 @@
+# DNS
+
+The router's name server (PowerDNS), the primary of the router's domains. Every domain has the
+same two name servers: the router's FQDN and a secondary name server. The [web sites](sites.md)
+whose DNS is Router managed get their records in the domain they are in.
+
+## Settings
+
+- **State:** disabled, running, or not running yet; the router installs PowerDNS when it is
+  enabled.
+- **Primary name server:** the router's FQDN, the SOA and the first NS of every domain. It is the
+  router's name and is not edited here; its own A record is kept by the DNS of its domain,
+  wherever that is, not by the router's domains.
+- **Secondary name server:** the second NS of every domain, required while the name server is
+  enabled. The router notifies the addresses it resolves to of every change and allows them to
+  transfer the domains.
+- **Public IP address:** the router's public IP, which the records of the sites with Public IP
+  take; empty when the router has none or no site uses it.
+- **Listen:** the interfaces port 53 is open on. While IKEv2 or OpenVPN remote access is enabled,
+  it must not share an interface with the clients' resolver, by default on the internal one.
+- **TTL:** how long resolvers keep the answers of a domain without its own TTL.
+
+**Settings** edits them.
+
+## Domains
+
+**Add domain** takes the domain and an optional TTL; the edit button changes the TTL, and the
+remove button removes a domain with its manual records. A domain inside another domain of the
+router is delegated from it.
+
+A domain the router hosts, for example `example.com`, with the router's FQDN `router.other.net`,
+the secondary `ns2.provider.net`, and a Router managed site of `www.example.com` and
+`example.com` with Public IP `203.0.113.10`:
+
+```text
+example.com.      SOA  router.other.net. hostmaster.example.com. <serial> 10800 3600 604800 300
+example.com.      NS   router.other.net.
+example.com.      NS   ns2.provider.net.
+example.com.      A    203.0.113.10
+www.example.com.  A    203.0.113.10
+```
+
+Selecting a domain shows:
+
+- **Records served:** what the name server answers, including the SOA and NS records.
+- **Manual records:** the records added with **Add record**: A, AAAA, CNAME, TXT, MX, SRV or CAA.
+  A name is relative to the domain, `@` for the domain itself. A record of a name and type the
+  domain already has from its name servers or its sites is not served.
+
+Changes are served after the router applies them, a few seconds later; **Refresh** shows them.
+
+## Delegation
+
+The parent of each domain must delegate it: NS records naming the router's FQDN and the secondary
+name server, and, for a name server inside the domain, its A record (a glue record), at the
+registrar or DNS provider of the parent.

docs/docker.md

@@ -0,0 +1,11 @@
+# Docker
+
+Whether Docker is installed on the router, the state of `docker.service` and of the router's
+Docker rules, the ports exposed on the external interface, and the rules of the
+`VPN-ROUTER-DOCKER` chain.
+
+Exposed ports are set on the router as root, for example:
+
+```sh
+vpn-config-edit set --restart docker.exposed_ports 443,8000:8100
+```

docs/groups.md

@@ -0,0 +1,18 @@
+# Groups
+
+The groups of the router's directory, with their descriptions and members.
+
+- **Add** and **Edit:** the name, the description and the members in one dialog. A group has at
+  least one member: a user or a service account, but not an internal one.
+- **Remove:** removes the group; its members are kept, and it is taken out of the roles assigned
+  to it. A group that a client of the [OpenID Provider](service-accounts.md#openid-provider) allows
+  cannot be removed.
+
+## Groups the router reads
+
+- **admins:** its members use all pages of the Manager. Only root on the router changes it, with
+  `vpn-router-group` or a token of `vpn-router-token`.
+- **Allowed groups** of an OpenID Connect client: only their members may sign in to that client.
+  Renaming a group renames it in those clients.
+- **Roles** of a resource of the OpenID Provider assigned to a group are roles of its members, in
+  the tokens for that resource. Renaming a group renames it in those roles.

docs/index.md

@@ -0,0 +1,36 @@
+# VPN Router Manager Documentation
+
+The VPN Router Manager shows the state of a router running the `vpn-router` package and manages
+its users, connections, certificates and services. Members of the router's group `admins` see all
+pages; any other user sees only their own account.
+
+The help opens at the topic of the page you are on. Links between topics open in this panel;
+Back returns to the previous topic and the house icon to this one.
+
+## Pages
+
+| Page | Topics |
+| --- | --- |
+| Router | [Overview](router.md), [Metrics](metrics.md), [Logs](logs.md), [Backup](backup.md), [System](system.md) |
+| Identities | [Users](users.md), [Groups](groups.md), [Service accounts](service-accounts.md) |
+| Connectivity | [Site-to-site connections](site-to-site.md) |
+| Remote Access | [IKEv2, OpenVPN and WireGuard](remote-access.md) |
+| Certificates | [Certificates](certificates.md) |
+| Web Sites | [Sites](sites.md), [Files](site-files.md), [DNS](dns.md) |
+| Docker | [Docker](docker.md) |
+| Header | [Shell](shell.md), [Account](account.md) |
+
+## Header
+
+- **Page menu** (right end): switches between the pages; its button names the page shown.
+- **Help** (question mark, left of the page menu): opens and closes this panel; the page moves left
+  while it is open.
+- **Shell** (terminal icon, administrators): a shell on the router; pressed on the Shell page, it
+  returns to the page it was opened from.
+- **Your name**: opens your account; pressed there, it returns to the page it was opened from.
+- **Sign out**, **Settings** (gear, but not on the account page) and **Theme** (light, dark or the system's).
+
+## Settings
+
+The gear, hidden on the sign-in and the account page, sets how often the Overview and the Metrics tab read the router on their own: manually, or
+every 5, 10 or 30 seconds, 1, 5 or 15 minutes. The browser keeps the choice; Defaults sets it back.

docs/logs.md

@@ -0,0 +1,26 @@
+# Logs
+
+The last lines of the router's logs.
+
+## Sub-tabs
+
+- **Journal:** the systemd journal of one of the router's units, or of all units.
+- **Files:** a log file the router lists in its setting `web.log_files`. Files are added on the
+  router as root:
+
+  ```sh
+  vpn-config-edit set web.log_files /var/log/syslog,/var/log/auth.log
+  ```
+
+## Controls
+
+- **Unit** or **File:** the log shown.
+- **Lines:** 100, 200, 500 or 1000 of the last lines; the router answers at most 1000 at a time,
+  and reads at most the last MiB of a file.
+- **Follow:** reads the log every 2 seconds and keeps the view at its last line, as `tail -f`
+  does. Refresh is off meanwhile.
+- **Refresh:** reads the log again. A log is also read when the unit, the file or the number of
+  lines changes.
+
+Older lines stay on the router: `journalctl` and the files themselves, over SSH or the
+[Shell](shell.md).

docs/metrics.md

@@ -0,0 +1,22 @@
+# Metrics
+
+Charts of the router over the last hour, day, month or year, read every minute by default (see
+[Settings](index.md#settings)).
+
+## Charts
+
+- CPU, memory, free disk space in bytes and in percent, and the load averages.
+- Bytes per second of each interface, and the VPN clients.
+- Per site-to-site connection: **Site-to-site up**, **Site-to-site traffic** and
+  **Site-to-site packets**.
+
+## Controls
+
+- **Hour, Day, Month, Year:** the period shown.
+- **Average, Maximum:** how each point sums up its time slot. Site-to-site up is always the
+  percentage of the slot the connection was up: 5 minutes for an hour, 1 hour for a day, 1 day
+  for a month and 1 month for a year.
+- **Legend:** a click on a line's legend item hides or shows the line, for example the 1 and 5
+  minute load averages to see the 15 minute one. The browser keeps the hidden lines.
+- The charts fold, hide, move and change width as the [Router](router.md#layout) panels do, with
+  a layout of their own.

docs/remote-access.md

@@ -0,0 +1,41 @@
+# Remote Access
+
+A tab each for IKEv2, OpenVPN and WireGuard access: the settings, whether the router
+runs the system, why an enabled one does not run yet, and the connected clients.
+
+## Edit
+
+Enables or disables the system and sets its address pool (for WireGuard the address of `wg0`) and
+its port, with OpenVPN's protocol. The router applies a change in the background.
+
+IKEv2 and OpenVPN also need the router's `wan.local_fqdn` and its VPN server certificate. A cloud
+firewall in front of the router, such as an Azure network security group, must allow the OpenVPN
+and WireGuard ports itself.
+
+## IKEv2
+
+The IPsec security associations, child SAs, connections and connection children of IKEv2 access.
+
+**DNS domains** (Edit, one per line): the domains, with their subdomains, the clients resolve with
+the router's DNS, such as `internal.cloudapp.net`; other names stay with the clients' own DNS. The
+router pushes them over IKEv2, and the Apple VPN profile names them, so a Mac, iPhone or iPad needs
+a newly downloaded profile after a change.
+
+## OpenVPN
+
+Users connect with the client profile downloaded on the [Users](users.md) tab, and sign in with
+their password and, when enrolled, the code.
+
+## WireGuard
+
+- **Connections:** each peer with its user, IPs, endpoint, handshake and traffic.
+- **Peers:** the devices of the VPN users, each with its user, public key and IPs.
+  - **Add peer:** the user, the device's public key and the IPs, which start as the next free
+    address of the `wg0` network. The router checks that keys are unique and IPs do not overlap.
+  - The eye opens the device's configuration; the download gives `<user>-<n>.conf`, with a
+    placeholder for the device's private key, which the router never has.
+  - The remove button removes a peer after a confirmation.
+- **Server:** the router's public key with a copy icon, the endpoint and the allowed IPs a device
+  needs; **Show config** opens a device configuration with placeholders.
+- In the configuration dialogs a switch leaves out the `[Interface]` and `PrivateKey` lines, which
+  WireGuard for Windows fills in for a new empty tunnel.

docs/router.md

@@ -0,0 +1,51 @@
+# Overview
+
+The Overview tab shows the state of the router, read every 10 seconds by default (see
+[Settings](index.md#settings)). The updates of the other packages of the system are on the
+[System](system.md) tab.
+
+## Panels
+
+- **Status:** the overall status, ok or degraded, on its title bar; the installed version of
+  `vpn-router` and, when the repository has a newer one, that version;
+  IKEv2, OpenVPN and WireGuard; the status web service and its port; HTTPS and the name it is for,
+  with a chip while the certificates come from Let's Encrypt's staging CA and a settings button
+  (see HTTPS settings below); and Caddy, its HTTPS proxy, with its version, where it comes from (Ubuntu or upstream) and the
+  state of `caddy.service`.
+- **Services:** the state of each of the router's systemd services and of Caddy; the chip on the
+  title bar tells whether the router's services are active.
+- **Addresses:** links to the status page over HTTPS and over plain HTTP, and to the Router
+  Manager over HTTPS, each opening in a new tab; and the issuer and the discovery URL of the
+  router's OpenID Provider, each with a copy icon, or off while the provider is disabled (see
+  [Service accounts](service-accounts.md#openid-provider)).
+- **Backup:** the result of the last run, the next run and Run now (see [Backup](backup.md)).
+- **PostgreSQL:** each cluster with its main settings and its databases with their sizes.
+- **Configuration:** the sections of the router's configuration the other pages do not show,
+  among them the status web service (`web`) and HTTPS (`https`).
+
+Caddy is switched to upstream's packages on the router as root with
+`vpn-router-caddy use-upstream`.
+
+## HTTPS settings
+
+The settings button of the HTTPS row switches **Let's Encrypt staging CA**. While it is on, Caddy
+takes every certificate, the web sites' included, from Let's Encrypt's staging environment, whose
+rate limits are far higher but whose certificates no browser trusts: it is for routers that are
+rebuilt often, for tests only. While it is off, Caddy takes its certificates from Let's Encrypt,
+and from ZeroSSL when Let's Encrypt refuses, such as for its limit of 5 certificates a week for the
+same name. Saving runs the router's setup again, which applies the change. The other HTTPS
+settings are changed on the router with `vpn-config-edit`.
+
+## Updates
+
+- **Check update** asks the router's package repository for newer versions.
+- **Upgrade** appears when one is found; it installs the new packages after a confirmation and
+  shows the upgrade's output. A reboot is offered when a package asks for one.
+- Nothing is read while a check, an upgrade or a reboot runs.
+
+## Layout
+
+- A panel folds by its title bar, and every panel but Status hides by its close icon; **Panels**
+  shows the hidden ones again.
+- **Edit layout** moves panels by dragging and switches each between one column and both.
+- The browser keeps the layout.

docs/service-accounts.md

@@ -0,0 +1,68 @@
+# Service accounts
+
+Accounts that other systems sign in with to use the router's services, such as an OpenTelemetry
+Collector reading the router's metrics. They cannot sign in to the Manager.
+
+## Columns
+
+- **Name:** a GUID, which Add proposes, or a user name.
+- **Kind:** a service account, or **Internal**: the router creates and manages an internal one for
+  its own services, so it has no actions here.
+- **OpenID Provider:**
+  - as a client: the number of redirect URIs and the allowed groups, the grants, `public`, and the
+    scopes it asks for;
+  - as a resource: its scopes and roles;
+  - `-` for none.
+
+## Actions
+
+- **Add** and **Edit:** the display name, the description, an optional e-mail address and the
+  OpenID Provider settings, as a client and as a resource; Add also takes the password.
+- **Password**, **Disable**, **Enable**, **Unlock** after failed logins, and **Remove**.
+
+## OpenID Provider
+
+The router can sign its users in to other systems with OpenID Connect. Its issuer and discovery
+URL are on the Addresses panel of the [Overview](router.md), each with a copy icon, and while it is
+enabled the title of the list has the number of its clients. It is turned on on the router as
+root:
+
+```sh
+vpn-config-edit set --restart oidc.enabled true
+```
+
+### As a client
+
+A service account with a redirect URI or a grant is a client:
+
+- **Client ID:** the account's name.
+- **Client secret:** the account's password.
+- **Redirect URIs:** where the provider sends the browser back after a sign-in; `https`, or
+  `http` for `localhost`, on any port. One per line. They give the client the authorization code
+  flow with PKCE (S256).
+- **Post-logout redirect URIs:** where the browser may go after signing out. One per line.
+- **Allowed groups:** only their members may sign in to the client; without any, every user may.
+- **Client credentials:** the client gets a token as its own service account, with its secret and
+  without a user, for jobs and scripts.
+- **Device authorization:** a program without a browser shows a code. The user opens the router's
+  device page, enters the code, signs in, and allows or denies the program.
+- **Public client (no secret):** for programs that cannot keep a secret, such as a CLI; it cannot
+  use client credentials.
+- **Client scopes:** the scopes of resources the client may ask for, as `<resource>:<scope>`.
+
+Users sign in on the router's page with their password and code, or with a passkey.
+
+### As a resource
+
+Every service account is also a resource: an application that checks the router's tokens, such
+as an S3 gateway. A client asks for a token for it by its name, or by asking for its scopes.
+
+- **Scopes:** what clients may ask to do there, such as `read`, asked for as `<name>:read`. A
+  scope a client may ask for cannot be removed.
+- **Roles:** names such as `Reader`, each assigned to groups, users and service accounts. A token
+  for the resource carries, in `roles`, the roles its user or service account holds, directly or
+  through a group.
+
+The tokens are signed JWTs, which the resource checks with the provider's keys. The access token
+names the resource as its audience, and carries the scopes granted and the roles. The ID token,
+for the client, carries the user's roles of the client itself.

docs/shell.md

@@ -0,0 +1,51 @@
+# Shell
+
+A login shell on the router, as your console account: your own POSIX account of the directory, or
+a local account root chose.
+
+- **Opening** asks for your password and code again, unless you used a shell within the router's
+  `web.shell_auth_timeout` minutes. **Open with a passkey** takes one of your passkeys instead,
+  unlocked with your device's PIN or biometrics; it shows when you have a passkey (see
+  [Account](account.md)).
+- **Closing:** the router ends the shell after `web.shell_idle_minutes` without a keystroke; the
+  page shows the reason and keeps the terminal readable.
+
+## Editor
+
+`vre FILE...` (or `vpn-router-editor FILE...`) in the shell opens the files in the editor of this
+page and returns at once:
+
+```sh
+vre /etc/hosts ~/notes.txt
+```
+
+- **Tabs:** each file has a tab with its name, and its path as the tooltip. A dot marks unsaved
+  changes, and the cross closes the tab, asking first when there are unsaved changes.
+- **Editor icon** (left of the shell icon): shown while a file is open. It switches between the
+  terminal and the editor; the shell keeps running.
+- **Minimap button** (left of Save): shows or hides the minimap at the right edge of the editor.
+  This browser remembers the choice.
+- **Save** (or Ctrl+S): writes the file on the router, as your console account. When the file
+  changed on the router after it was read, **Reload** takes the router's version and **Overwrite**
+  writes yours.
+- **Limits:** text files of up to 1 MiB, at most 20 at a time. A file that does not exist is
+  created when saved. A file your console account may not write cannot be saved; edit it in the
+  terminal.
+- **When files close:** when the shell ends, every file closes and the icon goes away. `vre`
+  works only in this shell.
+
+## Requirements
+
+- Membership of `admins`, enrolment for one-time passwords (see [Account](account.md)), also when
+  you open the shell with a passkey, as the router's login session and `sudo` need it, and console
+  login, which root switches on the router:
+
+  ```sh
+  vpn-router-user console <name> --posix
+  ```
+
+- The router offers the shell only while its `web.shell` is `true`:
+
+  ```sh
+  vpn-config-edit set web.shell true
+  ```

docs/site-files.md

@@ -0,0 +1,19 @@
+# Site files
+
+The files of one web site, a folder at a time. **Site** chooses the site; the path above the list
+leads back up to the site's folder, as does `..` in the list.
+
+## Actions
+
+- **Upload:** sends the chosen files into the folder shown. Files dropped on the list are
+  uploaded the same way.
+- **Extract zip archives:** while it is on, an uploaded `.zip` file is extracted into the folder
+  shown instead of being stored.
+- **New folder**, **Rename** and **Remove**; removing a folder removes everything in it.
+- A file's name or **Download** saves it.
+
+An upload shows its progress. A file larger than the largest upload of the
+[Web sites](sites.md) settings is not sent. A zip archive with a path that leaves the folder, a
+link, more than 10000 entries or more content than the largest upload is refused as a whole.
+
+Caddy serves a folder's index file, `index.html` unless the site names another.

docs/site-to-site.md

@@ -0,0 +1,30 @@
+# Site-to-site connections
+
+The Connectivity page: the router's IPsec site-to-site connections and its network.
+
+## Status tab
+
+Each connection the router set up, with the local and the remote identity, the subnets it
+resolved and how long it has been up, and their IPsec security associations, child SAs,
+connections and connection children. IKEv2 access connections are on the IKEv2 tab of
+[Remote Access](remote-access.md).
+
+## Network tab
+
+The external and the internal interface with their addresses, the internal gateway, the local
+CIDRs and the IPv4 routes. The panels fold, hide, move and change width; the browser keeps their
+layout.
+
+## Connections tab
+
+Each connection with its remote peer, remote identity, remote and local CIDRs, local identity mode,
+authentication and whether the tunnel is established.
+
+- **Add**, **Edit** and **Remove** (after a confirmation).
+- **Pre-shared key:** typed as a password; required while the connection has none and kept when
+  left empty; never shown.
+- **Certificates:** the PEM certificate of a remote CA is optional; without it the peer's
+  certificate must come from the router's site-to-site CA.
+
+The router applies a change in the background by running its setup again. The connection the
+router was installed with is `remote-site`.

docs/sites.md

@@ -0,0 +1,53 @@
+# Web sites
+
+Static web sites that Caddy serves on the router, each from its own folder,
+`/var/lib/vpn-router/sites/<name>`. The files of a site are on the [Files](site-files.md) tab, and
+the name server of their domain on the [DNS](dns.md) tab.
+
+## Settings
+
+- **State:** whether the sites are served.
+- **Largest upload:** the largest file or zip archive the Files tab and the router's API take.
+- **WebDAV:** whether the folders are served over WebDAV, and its URL with a copy icon.
+
+**Settings** edits them.
+
+## Columns
+
+- **URLs:** the addresses of the site, one per host name; a site without host names answers any
+  name on its port.
+- **Port** and **Listen:** the TCP port, and the interfaces its firewall opens: internal,
+  external or both.
+- **TLS:** None (plain HTTP), Let's Encrypt, an issuing CA of the Certificates page, or a
+  certificate and key given with the site.
+- **Editors:** the group whose members may change the files besides the admins.
+- **DNS:** who serves the records of the host names. **User managed:** a DNS provider outside the
+  router. **Router managed:** the router's name server gives each host name an A or AAAA record in
+  its domain on the [DNS](dns.md) tab, with the router's **Public IP** (the Public IP address of
+  the DNS settings), **Internal interface IP** or **External interface IP**. A host name in none of
+  the router's domains gets no record.
+
+A host name may be the router's FQDN, on a port of the site's own, such as 443, which the router's
+own services leave free. Such a site is User managed: the record of the router's FQDN stays with
+the DNS of its domain.
+
+## Actions
+
+- **Add** and **Edit:** the settings of a site; the name is fixed once added.
+- **Files** opens the site on the Files tab.
+- **Disable**, **Enable**, and **Remove**, which keeps the folder unless asked to remove it.
+
+## Rules
+
+- The router's own ports, such as 22, 7081, 7443, 7444 and 7445, cannot be taken by a site.
+- Sites sharing a port need host names of their own, the same Listen and the same kind of TLS.
+- Let's Encrypt needs host names that resolve to the router from the internet, and port 80.
+- A certificate and key must belong together and name the host names.
+- An issuing CA's certificates are trusted by browsers that trust the router's root CA.
+
+## WebDAV
+
+With WebDAV on, a WebDAV client signs in at the WebDAV URL with a user name and password of the
+router, followed by the TOTP code for an enrolled user. Admins see a folder for every site, other
+users the folders of the sites whose editors group they are members of. An upload reaches the site
+a few seconds after it is written.

docs/system.md

@@ -0,0 +1,17 @@
+# System
+
+The System tab manages the router's operating system.
+
+## System updates
+
+- The panel lists the packages `apt-get upgrade` would upgrade, each with its installed and its
+  new version, as of apt's last update of its package lists.
+- **Check update** updates apt's package lists and lists the packages again.
+- **Upgrade** appears when a package can be upgraded; after a confirmation it runs
+  `apt-get upgrade -y` on the router and shows its output. It upgrades the installed packages
+  only: none is installed or removed, and a package that needs a new one is kept back.
+- Services restart during the upgrade; when `vpn-router` is upgraded, the page may not
+  answer for a while, and **Reload page** loads its new version.
+- A reboot is offered when a package asks for one, as after a new kernel.
+- Only one upgrade runs at a time: this one or the upgrade of `vpn-router` on the
+  [Overview](router.md) tab.

docs/users.md

@@ -0,0 +1,34 @@
+# Users
+
+The users of the router's directory, without the [service accounts](service-accounts.md).
+
+## Kinds of users
+
+- **VPN user:** a first name, a last name, an e-mail address and a certificate; signs in to
+  OpenVPN, IKEv2 and WireGuard, and to the Manager.
+- **Manager-only account:** a name, a password and an optional e-mail address; no certificate and
+  no VPN access.
+
+## Columns
+
+- **OTP:** whether the user is enrolled for one-time passwords (TOTP).
+- **Passkeys:** how many passkeys the user signs in to the Manager with.
+- **Console:** for a member of `admins`, the console login: off, the user's own POSIX account with
+  its uid, or the local account it runs as; marked as refused while the user is not enrolled for
+  TOTP. Root switches it on the router with `vpn-router-user console`.
+
+## Actions
+
+- **Add:** a VPN user, or with Manager access only a Manager-only account.
+- **Edit:** the names and the e-mail address of a VPN user, the e-mail address of a Manager-only
+  account.
+- **Password**, **Disable**, **Enable**, **Unlock** after failed logins, and **Remove**.
+- **Profile:** downloads the OpenVPN client profile, while the router runs OpenVPN.
+- **Apple VPN profile** (Apple icon): downloads a `.mobileconfig` that sets up the router's IKEv2
+  VPN on a Mac, iPhone or iPad, while the router runs IKEv2. The password you type protects the
+  user's key in the profile; the device asks for it when the profile is installed.
+- **OTP:** enrols an authenticator app with a QR code, stored once a code of the app is entered,
+  or removes the enrolment.
+- **Remove passkeys:** removes all the user's passkeys.
+
+Five wrong passwords lock a user for 15 minutes; Unlock ends that sooner.