fix: the web service listens on the internal address, the external address or both.

README.md

@@ -123,10 +123,11 @@ must have the type shown below; an unknown section or setting is an error.
 | `openvpn` | `protocol` | string | `udp` | `udp` or `tcp` |
 | `docker` | `mode` | string | `auto` | `auto` secures Docker when its service is installed, `on` requires it, `off` removes the rules |
 | `docker` | `exposed_ports` | list | | TCP ports and port ranges (`8000:8100`) reachable from the external interface; at most 15, a range counting as two |
-| `web` | `enabled` | boolean | `true` | The status web service on the internal address |
+| `web` | `enabled` | boolean | `true` | The status web service |
+| `web` | `listen` | string | `both` | The interfaces the status web service listens on: `internal`, `external` or `both` |
 | `web` | `port` | integer | `7081` | TCP port of the status web service |
 | `web` | `database` | string | | A PostgreSQL connection string for the refresh tokens; without it, the `vpn-router` database on this host that the web service creates |
-| `web` | `trusted_proxies` | list | the listening address | Addresses whose `X-Forwarded-For` header names the client for the `/auth` rate limit |
+| `web` | `trusted_proxies` | list | the address the call came in on | Addresses whose `X-Forwarded-For` header names the client for the `/auth` rate limit |
 
 A minimal site-to-site configuration in `auto` mode:
 
@@ -492,8 +493,9 @@ modules shipped with the package; the configuration file accepts any module inst
 
 ## Status web service
 
-The `vpn-router-web` service shows the state of the router on its internal address and
-`web.port` (7081 by default). Its pages `/` and `/status` need no authentication and show no
+The `vpn-router-web` service shows the state of the router on the addresses of the interfaces
+`web.listen` names, the internal, the external or both (the default), and `web.port` (7081 by
+default). Its pages `/` and `/status` need no authentication and show no
 configuration: no key, identity, address or subnet.
 
 The service first makes its signing key and the refresh tokens' database, retrying every 15
@@ -585,7 +587,7 @@ removed. Changing a user's password, disabling, unlocking or removing the user r
 user's refresh tokens. Five failed logins lock the account for 15 minutes (see the user
 directory). `/auth` and `/auth/refresh` take at most 10 calls a minute from one client address,
 and answer 429 with `Retry-After` beyond that; for a call from one of `web.trusted_proxies`, by
-default the address the service listens on, the client address is the last entry of
+default the address the call came in on, the client address is the last entry of
 `X-Forwarded-For`.
 
 Refresh tokens are kept, as their SHA-256, in PostgreSQL: by default in the database and role
@@ -680,13 +682,14 @@ otherwise. `DELETE /users/<name>` is refused with 400 while the user is the last
 group.
 
 The service starts on its own, without waiting for `vpn-router-setup`, and keeps running. Every
-30 seconds it works out the internal address from `vpn-router.json` as `general.mode` directs,
-and reads `web.port` and `web.enabled`; it listens there, moves when the address or the port
-changes, and stops listening while `web.enabled` is `false` or the address is not known. Each
-request reads the signing key and `vpn-router.json`, and the features and the facts for
-`/config` from `/run/vpn-router/web.json` (readable by root only), which `vpn-router-setup` writes;
-before that file exists the page shows no features. `vpn-router-setup` opens `web.port` on the
-internal interface in the firewall.
+30 seconds it reads `web.listen`, `web.port` and `web.enabled` from `vpn-router.json` and works
+out the addresses of the interfaces `web.listen` names as `general.mode` directs; it listens on
+each, moves when an address or the port changes, and stops listening while `web.enabled` is
+`false` or no address is known. A change of `web.listen` takes effect within 30 seconds, or when
+the service restarts. Each request reads the signing key and `vpn-router.json`, and the features
+and the facts for `/config` from `/run/vpn-router/web.json` (readable by root only), which
+`vpn-router-setup` writes; before that file exists the page shows no features.
+`vpn-router-setup` opens `web.port` on the internal and the external interface in the firewall.
 
 ## Router Manager
 
@@ -694,8 +697,9 @@ The `vpn-router-manager` package, built in the repository `linux-cloud-router-ma
 application that shows the state of the router and manages its users through the status web
 service. It can be installed on the router or on another Linux system. While it is installed on
 the router, `vpn-router-setup` opens its port (`port` in `/etc/vpn-router-manager/manager.json`,
-7080 by default, HTTP; 7443 is kept for it with TLS) on the internal interface; restart
-`vpn-router-setup` after changing it.
+7080 by default, HTTP; 7443 is kept for it with TLS) on the internal and the external
+interface; restart `vpn-router-setup` after changing it. The manager's `listen` chooses the
+interfaces it listens on.
 
 ## Removal