fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.

debian-package/debian/changelog

@@ -1,3 +1,17 @@
+vpn-router (0.18.1-1) unstable; urgency=medium
+
+  fix: vpn-router-setup owns only the creation of the metrics service's account, which is marked internal, and administrators add service accounts with vpn-router-user add --service and /users.
+
+  * POST /users takes "service": true and adds a service account, which
+    cannot sign in to /auth; vpn-router-user add takes --service.
+  * The users of /users and vpn-router-user have internal, true for the
+    account metrics.service_account names while metrics are enabled;
+    vpn-router-user list shows its kind as internal.
+  * PUT /users/<name>/password refuses the internal service account,
+    whose password vpn-router-setup keeps.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 26 Oct 2026 17:00:00 +0100
+
 vpn-router (0.18.0-2) unstable; urgency=medium
 
   update: release.py tags a Debian revision other than 1 as x.y.z-n.