fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.

README.md

@@ -427,9 +427,11 @@ it is added:
   name, the password and an optional e-mail address, for notifications: no names and no
   certificate, so no VPN access. It can sign in to `/auth` and, as a member of `admins`, manage
   the router. `add` without the first and the last name adds one; its names cannot be set later;
-- a service account, a Manager-only account whose `vpnRouterScope` is `service`, which
-  `vpn-router-setup` adds and keeps for the metrics service (see Metrics); it cannot sign in to
-  `/auth`, and `vpn-router-user` and `/users` cannot add one.
+- a service account, a Manager-only account whose `vpnRouterScope` is `service`, for a service
+  that checks passwords against the directory; it cannot sign in to `/auth`. `add --service` and
+  `POST /users` with `"service": true` add one. The internal one is the account
+  `metrics.service_account` names while metrics are enabled: `vpn-router-setup` adds it and keeps
+  its password (see Metrics), so `/users` refuses to set its password.
 
 Passwords and TOTP secrets are read from the first line of standard input. The answer is text: a
 table of the users, the client profile, a TOTP secret or a short message, and a failure is a
@@ -441,6 +443,7 @@ after a command its options.
 ```sh
 echo 's3cr3t-pass' | vpn-router-user add alice --first-name Alice --last-name Smith --email alice@example.com
 echo 'm4nager-pass' | vpn-router-user add ops
+echo 's3rvice-pass' | vpn-router-user add backup --service
 vpn-router-user update alice --email a.smith@example.com
 vpn-router-user list
 vpn-router-user profile alice > alice.ovpn
@@ -460,6 +463,7 @@ vpn-router-user otp-remove alice
 | `list` | The users with their kind, names and e-mail addresses, whether each is enabled or locked, has a certificate and is enrolled for TOTP |
 | `add <name> --first-name F --last-name L --email E` | Adds a VPN user and issues the certificate |
 | `add <name> [--email E]` | Adds a Manager-only account, with the e-mail address when given; one name without the other two options is refused |
+| `add <name> --service [--email E]` | Adds a service account, with the e-mail address when given; the names are refused |
 | `update <name> [--first-name F] [--last-name L] [--email E]` | Changes the names or the e-mail address |
 | `passwd <name>` | Sets the password |
 | `disable <name>`, `enable <name>` | Locks the user out of OpenVPN and `/auth`, and lets the user in again |
@@ -474,8 +478,8 @@ A user name is 1 to 32 lowercase letters, digits and hyphens, starting with a le
 password has 8 to 128 characters; a first or last name has 1 to 64 printable characters; an
 e-mail address has one `@`, no spaces and a dot in its domain; a TOTP secret is 32 base32
 characters, as `otp-new` makes it, and a code 6 digits. Once enrolled, a user logs in to OpenVPN
-and `/auth` with the password followed by a current code. In the answers `manager_only` tells the
-kind, and a Manager-only account has its names as `null`; `update` changes only its e-mail
+and `/auth` with the password followed by a current code. In the answers `manager_only`, `service`
+and `internal` tell the kind, and a Manager-only account has its names as `null`; `update` changes only its e-mail
 address, and `--email ''` removes it. Changing a user's password, disabling, unlocking or removing the user also revokes its
 refresh tokens of `/auth`. The exit status is 0 on success, 2 for an invalid request, 3 when the
 user does not exist, 4 when the user exists and 1 for any other failure.
@@ -712,10 +716,10 @@ and answer bodies are JSON; a request body is at most 4096 bytes.
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /users` | | `{"users": [{"name", "manager_only", "enabled", "locked", "certificate", "otp", "first_name", "last_name", "email"}, ...]}` |
-| `POST /users` | `{"name", "password", "first_name", "last_name", "email"}` for a VPN user; `{"name", "password", "email"?}` for a Manager-only account | 201 and the user |
+| `GET /users` | | `{"users": [{"name", "manager_only", "service", "internal", "enabled", "locked", "certificate", "otp", "first_name", "last_name", "email"}, ...]}` |
+| `POST /users` | `{"name", "password", "first_name", "last_name", "email"}` for a VPN user; `{"name", "password", "email"?}` for a Manager-only account; `{"name", "password", "service": true, "email"?}` for a service account | 201 and the user |
 | `PUT /users/<name>` | any of `{"first_name", "last_name", "email"}`; for a Manager-only account only `{"email"}`, `""` removing it | the user |
-| `PUT /users/<name>/password` | `{"password": ...}` | the user |
+| `PUT /users/<name>/password` | `{"password": ...}`; refused with 400 for the internal service account | the user |
 | `POST /users/<name>/disable` | | the user |
 | `POST /users/<name>/enable` | | the user |
 | `POST /users/<name>/unlock` | | the user |