update: Added OpenLDAP and OpenVPN to the router.

README.md

@@ -4,6 +4,8 @@ A Debian package that configures a Linux host or virtual machine as a VPN router
 
 - site-to-site IKEv2 IPSec with pre-shared key authentication (strongSwan swanctl)
 - road-warrior (P2S) access using IKEv2 EAP-TLS, with a bundled certificate authority
+- OpenVPN (P2S) access with a certificate and a password per user, the users kept in a local
+  LDAP directory and managed with `vpn-router-user` or the web service
 - optional WireGuard endpoint
 - routing and NAT for a protected subnet, TCP MSS clamping, and UFW firewall rules
 - firewall rules for the ports Docker publishes, when Docker is installed
@@ -113,6 +115,10 @@ must have the type shown below; an unknown section or setting is an error.
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
 | `wireguard` | `address` | string | | Address and prefix for `wg0`, for example `192.168.200.1/24` |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
+| `openvpn` | `enabled` | boolean | `false` | OpenVPN access for users |
+| `openvpn` | `address_pool` | string | | IPv4 CIDR assigned to OpenVPN clients |
+| `openvpn` | `port` | integer | `1194` | Port of the OpenVPN server on the external interface |
+| `openvpn` | `protocol` | string | `udp` | `udp` or `tcp` |
 | `docker` | `mode` | string | `auto` | `auto` secures Docker when its service is installed, `on` requires it, `off` removes the rules |
 | `docker` | `exposed_ports` | list | | TCP ports and port ranges (`8000:8100`) reachable from the external interface; at most 15, a range counting as two |
 | `web` | `enabled` | boolean | `true` | The status web service on the internal address |
@@ -138,7 +144,7 @@ A minimal site-to-site configuration in `auto` mode:
 The router's IKE identity (`wan.local_fqdn` in `fqdn` mode) and the remote one (`remote.id`) are
 an FQDN or an IPv4 or IPv6 address. They are written to the strongSwan configuration as given;
 strongSwan reads an address as an IP identity and a name as an FQDN, so a leading `@` is not needed
-and is refused. Road-warrior access needs a name in `wan.local_fqdn`.
+and is refused. Road-warrior and OpenVPN access need a name in `wan.local_fqdn`.
 
 WireGuard peers are added by hand in `/etc/wireguard/wg0.conf`. The package owns the
 `[Interface]` section of that file and rewrites it when the settings above change, but it
@@ -234,8 +240,10 @@ systemctl restart vpn-router-setup
 The service also runs at boot. With platform `none` it does nothing and says so.
 Otherwise it regenerates the configuration files, resolves the interfaces and their
 addresses as `mode` directs, applies routes, generates WireGuard keys and injects
-firewall rules. It then starts `strongswan` and `wg-quick@wg0` if the corresponding
-feature is configured, reloading or restarting them only when their inputs changed, and
+firewall rules. It provisions the user directory in `slapd` while OpenVPN or road-warrior
+access is configured. It then starts `strongswan`, `wg-quick@wg0` and
+`openvpn-server@vpn-router` if the corresponding feature is configured, reloading or
+restarting them only when their inputs changed, and
 restarts `systemd-resolved` only when the road-warrior DNS drop-in changed. Turning a
 feature off in the configuration stops its service and removes its files. Every step is
 idempotent, so restarting with no changes does nothing.
@@ -264,8 +272,10 @@ ca_cert.pem  ca_key.pem  ca_bundle.pem  <label>_cert.pem  <label>_key.pem  crl.p
 `<label>` is the first component of the router FQDN, so `router.example.com` gives
 `router_cert.pem`.
 
-If road-warrior access is enabled and this directory is empty, a certificate authority and
-a server certificate are created there automatically. To use your own instead, place the
+If road-warrior or OpenVPN access is enabled and this directory is empty, a certificate
+authority, a server certificate and a CRL valid for ten years are created there
+automatically; a CA without a CRL gets one. User certificates are issued by
+`vpn-router-user` into `users/`. To use your own instead, place the
 files in that layout before enabling the feature; nothing is generated or overwritten when
 material is already present.
 
@@ -285,6 +295,73 @@ Issue a client certificate with the bundled tool:
 `simple-ca` comes from a separate project, <https://gitea.koszewscy.waw.pl/slawek/simple-ca>,
 and also supports `make-crl` and `revoke-cert`.
 
+## OpenVPN and users
+
+With `openvpn.enabled`, an `address_pool` and `wan.local_fqdn` set, `vpn-router-setup` runs
+`openvpn-server@vpn-router` with `/etc/openvpn/server/vpn-router.conf`. The server uses the
+router's CA, certificate and CRL (the copies under `/etc/swanctl`), pushes routes to
+`local.cidrs` and the router as DNS server, and opens `openvpn.port` on the external interface.
+
+A client needs both a certificate of the router CA and the password of the user the
+certificate names:
+
+- the certificate is checked against the CA and the CRL (`crl-verify`, read at every
+  connection);
+- the password is checked by `openvpn-auth-ldap`, which binds to the user directory as the
+  user;
+- `/usr/lib/vpn-router/openvpn-same-user` refuses a login whose user name is not the common
+  name of the certificate.
+
+### The user directory
+
+While OpenVPN or road-warrior access is configured, `vpn-router-setup` keeps a directory of
+users in the local slapd:
+
+- its own database, `dc=vpn-router,dc=local` in `/var/lib/ldap/vpn-router`, next to the one the
+  slapd package creates; root manages it through the local socket, with no administrator
+  password;
+- `ou=users` holds one `inetOrgPerson` per user, named by `uid`;
+- `cn=user-manager,ou=services` is the account that changes users; it may write `ou=users` and
+  set passwords, never read them, and its password is in
+  `/etc/vpn-router/ldap/user-manager.secret` (root only);
+- passwords are stored as ARGON2 hashes, and a disabled user is locked with the password policy
+  (`pwdAccountLockedTime`);
+- slapd listens on its local socket only (`SLAPD_SERVICES` in `/etc/default/slapd`).
+
+The directory is kept when OpenVPN and road-warrior access are switched off, and on purge.
+
+### Managing users
+
+`vpn-router-user` manages the users. A user is the directory entry and a client certificate
+with the user name as its common name, in `/etc/vpn-router/pki/users`. Passwords are read from
+the first line of standard input. The answer is JSON.
+
+```sh
+echo 's3cr3t-pass' | vpn-router-user add alice
+vpn-router-user list
+vpn-router-user profile alice
+echo 'n3w-pass' | vpn-router-user passwd alice
+vpn-router-user disable alice
+vpn-router-user enable alice
+vpn-router-user remove alice
+```
+
+| Command | Effect |
+| --- | --- |
+| `list` | The users, whether each is enabled and has a certificate |
+| `add <name>` | Adds the user and issues the certificate |
+| `passwd <name>` | Sets the password |
+| `disable <name>`, `enable <name>` | Locks the user out of OpenVPN, and lets the user in again |
+| `remove <name>` | Revokes the certificate, renews the CRL and removes the user |
+| `profile <name>` | The OpenVPN client profile, with the CA, the certificate and the key inline |
+
+A user name is 1 to 32 lowercase letters, digits and hyphens, starting with a letter; a
+password has 8 to 128 characters. The exit status is 0 on success, 2 for an invalid request,
+3 when the user does not exist, 4 when the user exists and 1 for any other failure.
+
+The certificate is also accepted by road-warrior (IKEv2 EAP-TLS) access, which checks
+certificates only, so `disable` does not affect it; `remove` revokes the certificate for both.
+
 ## Platform modules
 
 Platform-specific values do not belong in the core, so they are Python modules in
@@ -334,12 +411,15 @@ authentication, and shows no configuration: no key, identity, address or subnet.
 
 | Page | Content |
 | --- | --- |
-| `/` | The status for people: plain text for `curl` and `wget`, a page styled with Tailwind CSS for a browser (the style sheet is loaded from a CDN, so the browser needs internet access; the text is readable without it) |
+| `/` | The status for people: plain text for `curl` and `wget`, a page styled with Tailwind CSS for a browser, in the browser's light or dark scheme, that reloads itself every minute (the style sheet is loaded from a CDN, so the browser needs internet access; the text is readable without it) |
 | `/status` | The same status as JSON |
 | `/config` | The configuration with its secrets masked, and what the router resolved and runs, as JSON; needs a token |
+| `/users` | The users of OpenVPN and road-warrior access; needs a token |
 
 The status holds the state of `vpn-router-setup`, of `strongswan` when site-to-site or road-warrior
-access is configured, and of `wg-quick@wg0` when WireGuard is; the package version; whether
+access is configured, of `wg-quick@wg0` when WireGuard is, of `openvpn-server@vpn-router` when
+OpenVPN is, and of `slapd` when either OpenVPN or road-warrior access is; the number of connected
+OpenVPN clients, from the server's status file, which OpenVPN rewrites every minute; the package version; whether
 Docker is installed, and when it is, the state of `docker.service` and of `vpn-router-docker`
 (the Docker rules), which do not change `status`; whether the
 site-to-site tunnel is established; the number of connected road-warrior (IPsec P2S) clients; and
@@ -388,6 +468,31 @@ print(f'{head}.{body}.{sign}')
 curl -H "Authorization: Bearer $TOKEN" http://10.0.0.4:8080/config
 ```
 
+### The /users API
+
+`/users` manages users with the same token as `/config`, by running `vpn-router-user`. Request
+and answer bodies are JSON; a request body is at most 4096 bytes.
+
+| Request | Body | Answer |
+| --- | --- | --- |
+| `GET /users` | | `{"users": [{"name", "enabled", "certificate"}, ...]}` |
+| `POST /users` | `{"name": ..., "password": ...}` | 201 and the user |
+| `PUT /users/<name>/password` | `{"password": ...}` | the user |
+| `POST /users/<name>/disable` | | the user |
+| `POST /users/<name>/enable` | | the user |
+| `DELETE /users/<name>` | | `{"name", "removed": true}` |
+| `GET /users/<name>/profile` | | `{"name", "profile"}`, the OpenVPN client profile |
+
+A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not
+exist, 409 for a user that exists and 500 otherwise. While neither OpenVPN nor road-warrior
+access is configured, `/users` answers 404. Passwords and private keys cross the internal
+network in plain HTTP, like the token.
+
+```bash
+curl -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
+     -d '{"name": "alice", "password": "s3cr3t-pass"}' http://10.0.0.4:8080/users
+```
+
 `vpn-router-setup` opens `web.port` on the internal interface in the firewall, writes the address,
 the port, the secret and the facts for `/config` to `/run/vpn-router/web.json` (readable by root
 only) and restarts the service, so a changed `web` section
@@ -397,15 +502,15 @@ applies with `systemctl restart vpn-router-setup`. The service ends without an e
 ## Removal
 
 `apt-get remove` stops `vpn-router-docker`, which removes the Docker rules. It terminates the
-tunnels and takes `wg-quick@wg0` down, but leaves the
+tunnels and takes `wg-quick@wg0` and `openvpn-server@vpn-router` down, but leaves the
 configuration in place. `strongswan` is left enabled, since it is a shared service that
 may be in use by something else.
 
 `apt-get purge` additionally removes the generated files and the firewall rules, restoring
 `/etc/ufw/before.rules` to its original content, and hands `vpn-router.json` back to `ucf`
-before deleting it so a later reinstall starts clean. Key material is never deleted:
-`/etc/vpn-router/pki`, the WireGuard key pair and everything under `/etc/swanctl` are left
-alone.
+before deleting it so a later reinstall starts clean. Key material and users are never
+deleted: `/etc/vpn-router/pki`, `/etc/vpn-router/ldap`, the user directory in slapd, the
+WireGuard key pair and everything under `/etc/swanctl` are left alone.
 
 ## Building