feature: the package installs the Router Manager, which is no longer a package of its own.

docs/remote-access.md

@@ -0,0 +1,41 @@
+# Remote Access
+
+A tab each for IKEv2, OpenVPN and WireGuard access: the settings, whether the router
+runs the system, why an enabled one does not run yet, and the connected clients.
+
+## Edit
+
+Enables or disables the system and sets its address pool (for WireGuard the address of `wg0`) and
+its port, with OpenVPN's protocol. The router applies a change in the background.
+
+IKEv2 and OpenVPN also need the router's `wan.local_fqdn` and its VPN server certificate. A cloud
+firewall in front of the router, such as an Azure network security group, must allow the OpenVPN
+and WireGuard ports itself.
+
+## IKEv2
+
+The IPsec security associations, child SAs, connections and connection children of IKEv2 access.
+
+**DNS domains** (Edit, one per line): the domains, with their subdomains, the clients resolve with
+the router's DNS, such as `internal.cloudapp.net`; other names stay with the clients' own DNS. The
+router pushes them over IKEv2, and the Apple VPN profile names them, so a Mac, iPhone or iPad needs
+a newly downloaded profile after a change.
+
+## OpenVPN
+
+Users connect with the client profile downloaded on the [Users](users.md) tab, and sign in with
+their password and, when enrolled, the code.
+
+## WireGuard
+
+- **Connections:** each peer with its user, IPs, endpoint, handshake and traffic.
+- **Peers:** the devices of the VPN users, each with its user, public key and IPs.
+  - **Add peer:** the user, the device's public key and the IPs, which start as the next free
+    address of the `wg0` network. The router checks that keys are unique and IPs do not overlap.
+  - The eye opens the device's configuration; the download gives `<user>-<n>.conf`, with a
+    placeholder for the device's private key, which the router never has.
+  - The remove button removes a peer after a confirmation.
+- **Server:** the router's public key with a copy icon, the endpoint and the allowed IPs a device
+  needs; **Show config** opens a device configuration with placeholders.
+- In the configuration dialogs a switch leaves out the `[Interface]` and `PrivateKey` lines, which
+  WireGuard for Windows fills in for a new empty tunnel.