feature: users sign in to the web service, and only members of admins manage the router.

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -54,12 +54,10 @@ SCHEMA = {
     'wireguard':  {'enabled': False, 'address': '', 'listen_port': 51820},
     'openvpn':    {'enabled': False, 'address_pool': '', 'port': 1194, 'protocol': 'udp'},
     'docker':     {'mode': 'auto', 'exposed_ports': []},
-    'web':        {'enabled': True, 'port': 7081, 'jwt_secret': ''},
+    # web.jwt_secret is read and ignored; the tokens are signed with vpnrouter_auth.WEB_KEY.
+    'web':        {'enabled': True, 'port': 7081, 'jwt_secret': '', 'database': '', 'trusted_proxies': []},
 }
 
-#: The shortest secret that signs the tokens of the status web service.
-WEB_SECRET_MIN = 32
-
 DOCKER_MODES = ('auto', 'on', 'off')
 
 OPENVPN_PROTOCOLS = ('udp', 'tcp')
@@ -262,9 +260,8 @@ def validate(cfg):
     if isinstance(web_port, bool) or not isinstance(web_port, int) or not 1 <= web_port <= 65535:
         raise ConfigError(f'web.port: {web_port!r} is not a valid port')
 
-    web_secret = _get(cfg, 'web', 'jwt_secret')
-    if web_secret and len(web_secret) < WEB_SECRET_MIN:
-        raise ConfigError(f'web.jwt_secret: use at least {WEB_SECRET_MIN} characters')
+    for item in _get_list(cfg, 'web', 'trusted_proxies'):
+        _check_address(item, 'web.trusted_proxies')
 
     docker_mode = _get(cfg, 'docker', 'mode')
     if docker_mode not in DOCKER_MODES: