feature: bootstrap diagnostics on port 17081 during the first setup.

README.md

@@ -473,21 +473,25 @@ The `vpn-router-web` service shows the state of the router on its internal addre
 `web.port` (7081 by default). Its pages `/` and `/status` need no authentication and show no
 configuration: no key, identity, address or subnet.
 
-The service starts in a starting phase: it makes its signing key and the refresh tokens'
-database, retrying every 15 seconds, for example while PostgreSQL is not running yet. Until that
-succeeds, `/` and `/status` show only the phase and its failure, with the state, the current step
-and the failure of the last run of `vpn-router-setup` (from `/run/vpn-router/setup.json`, which
-setup writes at every step), and every page answers 503 with `Retry-After`; then the pages below
-are served.
+The service first makes its signing key and the refresh tokens' database, retrying every 15
+seconds, for example while PostgreSQL is not running yet, and logs each failure; then it listens.
 
-```text
-VPN Router
-Status: starting
+### Bootstrap diagnostics
 
-Web service: creating the token database
-Web service failure: creating the token database failed: psql failed: ..., retrying every 15 s
-Setup: failed, step firewall, at 2026-10-25T02:00:00+0200
-Setup failure: vpn-router: error: /etc/ufw/before.rules does not exist
+Until a run of `vpn-router-setup` has succeeded, every run starts `vpn-router-bootstrap`, which
+serves diagnostics as plain text on port 17081 of every address, and the firewall opens 17081 and
+17080 (the Router Manager's bootstrap) on the internal interface. The first successful run stops
+the bootstrap services and closes their ports, and writes `/var/lib/vpn-router/setup.done`, after
+which they never run again; a failed run leaves them running, so the reason stays readable until
+a later run succeeds. The unit is never enabled.
+
+The page, read again every 10 seconds, shows the state, the step and the failure of the last
+setup run (`/run/vpn-router/setup.json`, which setup writes at every step), the state of the
+router's services, the failed units, the addresses and routes, `cloud-init status`, and the end of
+the logs of `vpn-router-setup` and `vpn-router-web`:
+
+```bash
+curl http://10.0.0.4:17081/
 ```
 
 | Page | Content |