fix: the web service works in every state of the router.

debian-package/debian/changelog

@@ -1,3 +1,21 @@
+vpn-router (0.5.1-1) unstable; urgency=medium
+
+  fix: the web service works in every state of the router.
+
+  * vpn-router-web works whether /etc/vpn-router/pki and
+    /etc/swanctl/x509crl exist or not; they exist only while OpenVPN or
+    road-warrior access is configured. The paths the unit may write are
+    used when they exist and ignored when they do not.
+  * vpn-router-web starts on its own and keeps running. Every 30 seconds a
+    discovery thread works out the internal address from vpn-router.json as
+    general.mode directs, with web.port and web.enabled, and starts, moves
+    or stops the server thread to match. Each request reads the token
+    secret, the features and the facts it shows. The service is no longer
+    ordered after vpn-router-setup, which no longer restarts it, and
+    web.json no longer holds the address, the port or the secret.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 10:00:00 +0200
+
 vpn-router (0.5.0-1) unstable; urgency=medium
 
   * OpenVPN P2S access, set in the openvpn section (enabled, address_pool,

debian-package/debian/install

@@ -1,6 +1,7 @@
 src/etc/sysctl.d/99-vpn-router.conf                   etc/sysctl.d/
 src/usr/lib/vpn-router/vpnrouter.py                   usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_ldap.py              usr/lib/vpn-router/
+src/usr/lib/vpn-router/vpnrouter_net.py               usr/lib/vpn-router/
 src/usr/lib/vpn-router/openvpn-same-user              usr/lib/vpn-router/
 src/usr/sbin/vpn-router-user                          usr/sbin/
 src/usr/lib/vpn-router/simple-ca                      usr/lib/vpn-router/

debian-package/debian/vpn-router.vpn-router-web.service

@@ -1,7 +1,7 @@
 [Unit]
 Description=VPN Router status web service
 Documentation=file:/usr/share/doc/vpn-router/README.md
-After=network-online.target vpn-router-setup.service
+After=network-online.target
 Wants=network-online.target
 
 [Service]
@@ -11,7 +11,7 @@ Restart=on-failure
 RestartSec=15
 NoNewPrivileges=yes
 ProtectSystem=strict
-ReadWritePaths=/run/vpn-router /etc/vpn-router/pki /etc/swanctl/x509crl
+ReadWritePaths=-/run/vpn-router -/etc/vpn-router/pki -/etc/swanctl/x509crl
 ProtectHome=yes
 PrivateTmp=yes