fix: the web service works in every state of the router.

debian-package/src/usr/lib/vpn-router/setup

@@ -378,15 +378,13 @@ def refresh_docker_rules():
 
 
 def refresh_web(cfg, ctx):
-    """Hand the web service what it needs and restart it.
+    """Hand the web service the features and facts it shows.
 
-    The service takes the address to bind to, the port, the features of the
-    router, the secret that signs its tokens, the configuration with its
-    secrets masked and the facts resolved from the system from a file here, so
-    that it needs nothing but the standard library and the configuration code.
-    The file is readable by root only. The service ends quietly when
-    web.enabled is false. The restart is queued, not waited for, because the
-    unit is ordered after vpn-router-setup.
+    The service reads the file at each request: the features of the router,
+    the configuration with its secrets masked and the facts resolved from the
+    system, which it cannot work out with the standard library alone. The file
+    is readable by root only. The service follows a changed address or port
+    itself.
     """
     masked = {
         section: {option: '********' if SECRET_OPTION.search(option) and value else value
@@ -397,10 +395,6 @@ def refresh_web(cfg, ctx):
     WEB_STATE.touch(mode=0o600)
     WEB_STATE.chmod(0o600)
     WEB_STATE.write_text(json.dumps({
-        'enabled': bool(ctx['web_enabled']),
-        'bind': ctx['int_addr'],
-        'port': ctx['web_port'],
-        'jwt_secret': cfg['web']['jwt_secret'],
         'site_to_site': bool(vpnrouter.s2s_ready(ctx)),
         'p2s': bool(vpnrouter.p2s_ready(ctx)),
         'wireguard': bool(vpnrouter.wg_ready(ctx)),
@@ -419,7 +413,6 @@ def refresh_web(cfg, ctx):
             'remote_cidrs': ctx['remote_cidr_list'],
         },
     }) + '\n', encoding='utf-8')
-    run(['systemctl', 'restart', '--no-block', 'vpn-router-web.service'], check=False)
 
 
 def main():