fix: /config no longer shows secret options.

debian-package/debian/changelog

@@ -1,3 +1,13 @@
+vpn-router (0.5.2-1) unstable; urgency=medium
+
+  fix: /config no longer shows secret options.
+
+  * The configuration shown by /config leaves out the secret options (psk,
+    jwt_secret, and options named like a password, token or key) instead of
+    showing them masked.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 24 Oct 2026 11:00:00 +0200
+
 vpn-router (0.5.1-1) unstable; urgency=medium
 
   fix: the web service works in every state of the router.

debian-package/src/usr/lib/vpn-router/setup

@@ -33,7 +33,7 @@ WEB_STATE    = pathlib.Path('/run/vpn-router/web.json')
 
 FILTER_ANCHOR = '# End required lines'
 
-#: Configuration options whose values are masked wherever the configuration is shown.
+#: Configuration options left out wherever the configuration is shown.
 SECRET_OPTION = re.compile(r'(^psk$)|secret|password|token|_key$')
 
 BLOCKS = (
@@ -381,14 +381,13 @@ def refresh_web(cfg, ctx):
     """Hand the web service the features and facts it shows.
 
     The service reads the file at each request: the features of the router,
-    the configuration with its secrets masked and the facts resolved from the
-    system, which it cannot work out with the standard library alone. The file
-    is readable by root only. The service follows a changed address or port
-    itself.
+    the configuration without its secret options and the facts resolved from
+    the system, which it cannot work out with the standard library alone. The
+    file is readable by root only. The service follows a changed address or
+    port itself.
     """
-    masked = {
-        section: {option: '********' if SECRET_OPTION.search(option) and value else value
-                  for option, value in options.items()}
+    public = {
+        section: {option: value for option, value in options.items() if not SECRET_OPTION.search(option)}
         for section, options in cfg.items()
     }
     WEB_STATE.parent.mkdir(parents=True, exist_ok=True)
@@ -400,7 +399,7 @@ def refresh_web(cfg, ctx):
         'wireguard': bool(vpnrouter.wg_ready(ctx)),
         'openvpn': bool(vpnrouter.openvpn_ready(ctx)),
         'users': bool(vpnrouter.p2s_ready(ctx) or vpnrouter.openvpn_ready(ctx)),
-        'configuration': masked,
+        'configuration': public,
         'network': {
             'external_interface': ctx['wan_iface'],
             'internal_interface': ctx['int_iface'],