fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.

ADR.md

@@ -121,25 +121,30 @@ and it is backed up with `slapcat`, not by copying files.
 
 Status: Accepted
 
-Context: The router CA issues client certificates for IKEv2. OpenVPN can check a certificate, a
-password, or both. With both, a certificate alone and a password alone are not enough, but
-`openvpn-auth-ldap` checks only the password of the user name given at login, which need not be
-the user of the certificate.
+Context: The P2S issuing CA (ADR-27) issues the users' client certificates, for IKEv2 and
+OpenVPN. OpenVPN can check a certificate, a password, or both. With both, a certificate alone and
+a password alone are not enough, but `openvpn-auth-ldap` checks only the password of the user name
+given at login, which need not be the user of the certificate. OpenVPN trusts every chain to a
+CA of its `ca` file and has no option that accepts one intermediate CA only, while the root also
+signs the site-to-site and the general-purpose CAs.
 
-Decision: OpenVPN checks the certificate against the CA and the CRL, the password with
-`openvpn-auth-ldap`, and runs `openvpn-same-user` as `auth-user-pass-verify` with `via-env`,
-which accepts the login only when the user name equals the certificate's common name. OpenVPN
-calls both and needs both to pass. A user's certificate has the user name as its common name, is
-issued when the user is added and revoked when the user is removed. The CRL is created with the
-CA, so that `crl-verify` has a file from the start, and is valid for ten years, because the router
-renews it only when it revokes a certificate. The server uses the router's own certificate, whose
-common name is `wan.local_fqdn`; the client profile checks that name (`verify-x509-name`), since
-the CA's certificates carry both the server and the client purpose.
+Decision: OpenVPN checks the certificate against the root and the P2S CA and their CRLs, which
+it needs for every CA of the chain, the password with `openvpn-auth-ldap`, and runs
+`openvpn-same-user` as `auth-user-pass-verify` with `via-env`, which accepts the login only when
+the user name equals the certificate's common name. `openvpn-issuer`, as `tls-verify`, accepts
+the certificate at depth 1 only when its SHA-256 fingerprint, which OpenVPN gives the script,
+is the P2S CA's. OpenVPN calls all of them and needs all to pass. A user's certificate has the
+user name as its common name, is issued with the template `vpn-user`, client authentication
+only, when the user is added, and revoked when the user is removed. The server uses the router's
+VPN server certificate, whose common name is `wan.local_fqdn`; the client profile checks that
+name (`verify-x509-name`).
 
 Consequences: Disabling a user locks the password, which stops OpenVPN but not IKEv2, which
-checks certificates only; removing a user revokes the certificate for both. A user's
-certificate expires after the CA's default of a year and is renewed by removing and adding the
-user again.
+checks certificates only; removing a user revokes the certificate for both. A certificate of
+another issuing CA with a user's name does not reach the password check. A user's certificate
+expires after the days of `vpn-user` and is renewed by removing and adding the user again. An
+expired root CRL stops every OpenVPN client, so an offline root needs its CRL renewed in time
+(ADR-28).
 
 ## ADR-6: The web service and vpn-router-user share one module for users
 
@@ -147,9 +152,9 @@ Status: Accepted
 
 Context: Users are managed from the command line, by an operator at a terminal, and through
 `/users` of the web service, by the Router Manager. Both must apply the same rules to names,
-passwords and person attributes, and both change the directory and the CA. `simple-ca` keeps
-the CA's state in one file, so two changes must not run at the same time. The web unit is
-sandboxed with `ProtectSystem=strict`.
+passwords and person attributes, and both change the directory and the PKI, whose CRL numbers and
+CRLs two changes must not write at the same time. The web unit is sandboxed with
+`ProtectSystem=strict`.
 
 Decision: `vpnrouter_users.py` holds the user operations, the checks and a session that takes a
 lock and the connection of the user manager account. The web service imports it and maps a
@@ -157,11 +162,14 @@ lock and the connection of the user manager account. The web service imports it
 the output, text for people and JSON with `--json`. The web unit allows writing the paths the
 operations need: `/run/vpn-router` for the lock, its `RuntimeDirectory`, which systemd creates
 before the service starts, also before setup has run, and keeps when it stops, as setup's state
-files are there too; `/etc/vpn-router/pki` for the certificates and the CA's state, and
-`/etc/swanctl/x509crl` for the published CRL.
+files are there too, and `/etc/swanctl/x509crl`, `/etc/openvpn/server` and
+`/var/lib/vpn-router/pki-publish` for the copies of the CRLs a revocation signs; the PKI itself is
+in the directory (ADR-32). The PKI module, `vpnrouter_pki.py`, works the same way for `/ca`,
+`vpn-router-ca` and `vpn-router-setup`, and its lock is the users' lock, as adding and removing
+a user issue and revoke a certificate.
 
-Consequences: The rules exist once. A request starts no process, and a password never leaves
-the process that received it. The web service imports `python3-ldap` and the package's
+Consequences: The rules exist once. A request starts no process but `swanctl --load-creds` after
+a revocation, and a password never leaves the process that received it. The web service imports `python3-ldap` and the package's
 configuration module. The API is protected by the tokens of ADR-3, so only members of `admins`
 and the holders of an admin token manage users.
 
@@ -245,12 +253,13 @@ Context: Users are prepared before a P2S system is switched on, and the Router M
 them on any configured router, with or without one.
 
 Decision: Once a platform is chosen, `vpn-router-setup` always provisions the user directory in
-slapd and the CA with its CRL; the server certificate follows once `wan.local_fqdn` is set.
-`/users` and `vpn-router-user` rely only on the directory and the CA. Only the OpenVPN client
-profile needs OpenVPN to be enabled.
+slapd and the PKI (ADR-27) with its CRLs; the router's certificates follow once `wan.local_fqdn`
+is set. `/users` and `vpn-router-user` rely only on the directory and the P2S CA. Only the
+OpenVPN client profile needs OpenVPN to be enabled.
 
-Consequences: slapd always holds the directory and the CA always exists on a configured router,
-even when no P2S system uses them. An operator who wants a CA of their own must place it before
+Consequences: slapd always holds the directory and the CAs exist on a configured router, even
+when no P2S system uses them; with an offline root the P2S CA, and so the users' certificates,
+wait for its certificate. An operator who wants a root CA of their own must place it before
 choosing the platform.
 
 ## ADR-11: Groups are groupOfNames entries that never become empty
@@ -465,11 +474,14 @@ Decision: The package defines its schema, `cn=vpn-router,cn=schema,cn=config`, w
 `vpnrouter_ldap.provision` adds when missing and keeps as `SCHEMA_ATTRIBUTE_TYPES` and
 `SCHEMA_OBJECT_CLASSES`. Its OID is `2.25.98477352595735834532404256531620013001`, made from a
 random UUID under the arc 2.25 (ITU-T X.667), which needs no registration; attribute types are
-under `.1` and object classes under `.2`. The first version has the attribute `vpnRouterScope`
-(multi-valued, case-insensitive strings) and the auxiliary class `vpnRouterAccount`,
-`MAY ( mail $ vpnRouterScope )`. Manager-only accounts have the class from their creation, so an
-e-mail address can be added later without changing their classes; VPN users get it once scopes are
-used.
+under `.1` and object classes under `.2`. It has the attribute `vpnRouterScope` (multi-valued,
+case-insensitive strings) and the auxiliary class `vpnRouterAccount`,
+`MAY ( mail $ vpnRouterScope $ displayName $ description )`; `displayName` and `description`, the
+standard attributes, are the display name and the description of a service account, which
+`account` cannot hold. Manager-only accounts have the class from their creation, so an e-mail
+address can be added later without changing their classes; VPN users get it once scopes are used.
+`vpnrouter_ldap.provision` replaces the definitions in `cn=config` that differ, so an extended class
+reaches an existing directory at the next setup run.
 
 Consequences: The schema check stays strict. New attributes extend `vpnRouterAccount`, and their
 OIDs continue the arcs. The scope `service` marks a service account (ADR-23). The OID must never
@@ -572,9 +584,11 @@ which another system signs in with to use a router service. Administrators add s
 with `vpn-router-user add --service` and the web service's `/service-accounts`.
 `/service-accounts` is a path of its own, apart from `/users`, which does not list or serve them:
 a service account has no names, certificate, profile or TOTP, and is not a person an
-administrator manages with the users. Internal service accounts are those the router creates and
-manages for its own services (`vpnrouter_users.internal_accounts`), so the system, not an
-administrator, owns them; at present that is the metrics service's. `/service-accounts` marks
+administrator manages with the users. A service account has a display name and a description
+besides its name, so an administrator can tell what each is for. Internal service accounts are
+those the router creates and manages for its own services (`vpnrouter_users.internal_accounts`),
+with every property, display name and description included, so the system, not an
+administrator, owns them; at present that is the metrics service's, which setup names Metrics. `/service-accounts` marks
 them as `internal` and only lists them: every other request on one, and putting one in or taking
 one out of a group at `/groups`, gets 403, whatever the token. The router changes them through the
 directory's user-manager account, not the API, and root may still with `vpn-router-user`. For the
@@ -601,18 +615,18 @@ upgrade restarts the process that starts it: the manager's postinst restarts
 `vpn-router-manager.service`, and the router's restarts `vpn-router-web` and `vpn-router-setup`. A
 child of the manager would be stopped with the manager's cgroup in the middle of dpkg, leaving
 packages half configured, and the manager's unit cannot run apt at all, since `ProtectSystem=strict`
-makes `/usr` and `/var/lib/dpkg` read-only. The package lists are updated by a cron job, not by the
-manager.
+makes `/usr` and `/var/lib/dpkg` read-only. Ubuntu's `apt-daily` timer updates the package lists
+twice a day, so a release newer than its last run is not seen until the next one.
 
 Decision: The manager starts the helper `/usr/lib/vpn-router-manager/upgrade` with `systemd-run` as
 the transient unit `vpn-router-manager-upgrade`, of its own cgroup and without a sandbox, and does
 not wait for it. The helper:
 
 - finishes an interrupted dpkg run with `dpkg --configure -a`;
-- runs `apt-get install --only-upgrade` of the two packages, non-interactive, keeping changed configuration files, with `needrestart` suspended, and waiting for the dpkg lock that the cron job may hold;
+- runs `apt-get install --only-upgrade` of the two packages, non-interactive, keeping changed configuration files, with `needrestart` suspended, and waiting for the dpkg lock that `apt-daily` or `unattended-upgrades` may hold;
 - records the state and the result in `/var/lib/vpn-router-manager/upgrade.json`, replaced by a rename, and the output in `upgrade.log`.
 
-A restarted manager reads them again. A state of running without an active unit is shown as interrupted. The manager reboots the router the same way, as a transient timer `vpn-router-manager-reboot` 5 seconds later, so the answer reaches the browser first. Only members of `admins`, as the router's `/account` answers, may start either.
+A restarted manager reads them again. A state of running without an active unit is shown as interrupted. The manager reboots the router the same way, as a transient timer `vpn-router-manager-reboot` 5 seconds later, so the answer reaches the browser first. It checks for updates the same way too: Check update runs `apt-get update` in the transient unit `vpn-router-manager-check`, which touches apt's update stamp when it succeeds, so an admin need not wait for the `apt-daily` timer. Only members of `admins`, as the router's `/account` answers, may start any of them.
 
 Consequences: The fixed unit name allows one upgrade at a time. The page loses the manager and the
 router's web service for a while during an upgrade and reads again until they answer. Sessions
@@ -674,3 +688,284 @@ one connection, dropping the others. A change through the API is answered before
 applied it, so a configuration that setup cannot apply shows in the setup state, not in the
 answer. A connection with a key file keeps it until a key is given through the API, which then
 replaces the file.
+
+## ADR-26: Backups are a staged, consistent copy, archived locally with tar and zstd or sent to a Proxmox Backup Server
+
+Status: Accepted
+
+Context: An image backup of the VM, such as Azure Backup, restores the whole disk. It cannot be
+exported as a file, read on another system, or restored onto a new VM. The state that matters is
+small, but it is spread over several places: `vpn-router.json` and the secrets, the PKI, the
+WireGuard keys and peers, the firewall rules, the slapd directory and, optionally, the
+PostgreSQL database. Only part of it can be made again: the CA, the password hashes and the TOTP
+secrets cannot. The API and the command-line tools change the configuration, the PKI and the
+directory while the router runs.
+
+Decision: `vpn-router-backup run`, started by a timer on `backup.schedule`, stages a copy of that
+state in one directory and then archives or sends it.
+
+- **Consistency:** the files are copied and the directory is written with `slapcat` while the
+  configuration lock and the users lock are held, the locks every change of the API and the tools
+  takes, so a user, their certificate and the CRL are copied together. `slapcat` reads the MDB
+  database consistently while slapd runs (ADR-4), and `pg_dump` reads a snapshot. Files that
+  `vpn-router-setup` regenerates are left out.
+- **Local target:** a tar archive compressed with zstd, both from the Ubuntu archive, so a local
+  backup needs nothing else and the archive can be read on any Linux system. A `pxar` archive
+  would need Proxmox's client and is not compressed.
+- **Retention:** local archives are pruned by the rules of Proxmox Backup Server's prune, so the
+  settings mean the same for both targets and can be checked with Proxmox's prune simulator.
+  Settings finer than the schedule do not apply.
+- **Cloud copy:** rclone, from the Ubuntu archive, copies the archives to any storage it
+  supports. The remote is defined in `/etc/vpn-router/rclone.conf` with `rclone config`, since
+  each backend has its own settings. `vpn-router.json` names only the remote, and the
+  configuration file is part of the backup. `sync` makes retention apply to the remote as well;
+  `copy` leaves it to the storage's lifecycle rules. Only this host's archives are included, so a
+  shared remote path is safe.
+- **Proxmox Backup Server:** the static `proxmox-backup-client` sends the staged directory as one
+  `pxar` archive of a host snapshot. Deduplication makes frequent backups cheap. The server's
+  prune jobs keep the snapshots, so the token needs only `DatastoreBackup`, which cannot delete.
+  The client is a suggestion, not a dependency, because it comes from Proxmox's repository, which
+  an Ubuntu system does not know. Without it, only a PBS backup fails.
+- **Restore:** only on the command line, as root. It replaces the directory and the database, so
+  it stops their services, keeps what it replaces and lets `vpn-router-setup` rebuild the rest.
+  The API offers no restore, so a stolen admin session cannot replace the router's keys.
+
+Consequences: A backup holds every secret of the router, including the keys of the issuing CAs
+and the root key while it is on the router, in plain form
+unless a PBS key file encrypts it, so where it is kept must be as safe as the router. A restore
+onto another VM brings back the old interface names and addresses, which may need changing. The
+timer's schedules are systemd's shorthands, so all backups of one schedule start at the same
+moment. A change of the users between the end of the copy and the next backup is in no backup
+until then.
+
+## ADR-27: A two-level CA with dedicated issuing CAs, whose root may be offline
+
+Status: Accepted
+
+Context: One self-signed CA signed every certificate of the router with the same server and
+client purposes, so a certificate for any use was also a VPN client certificate, and the key
+that signed everything had to stay on the router. The router needs CAs for the VPN clients, for
+site-to-site certificates and for the administrator's own uses, and a root whose key can be kept
+elsewhere. The `simple-ca` script handled one level and ran as a separate process with its own
+state file.
+
+Decision: The root signs only issuing CAs, path length 1; the issuing CAs, path length 0, sign
+the certificates. `p2s` signs the router's VPN server certificate and the users' certificates,
+`s2s` the site-to-site certificates, and the CAs of `pki.issuing_cas` what their templates
+allow. A template fixes the key, the lifetime, the key usages, the extended key usages, the kind
+of common name and the subject alternative names a certificate may have; `vpn-server` and
+`vpn-user` are issued by the router only, so no certificate for another use comes from the P2S
+CA. The module `vpnrouter_pki.py`, with `python3-cryptography` from the Ubuntu archive, builds
+the keys, certificates, CSRs and CRLs in the processes that need them, as the user module does
+(ADR-6); the settings are the `pki` section of `vpn-router.json`, and the CAs and the
+certificates are kept in the router's directory (ADR-32). Keeping the root key off the router is recommended, not required: while it is
+on the router a new issuing CA is signed at once, and while it is not the CA gets its key and a
+CSR, signed offline and imported with `vpn-router-ca` or `/ca`. The root key itself crosses
+neither the API nor the Manager. For a certificate of something other than the router, the router
+signs the requester's CSR, or makes the key and returns it once in a PKCS#12 file, keeping only
+the certificate, so a key it gave away cannot leak from it later. The PKCS#12 file uses 3DES and
+SHA-1 MACs, the encryption the key stores of Windows and macOS import. strongSwan reads only the
+first certificate of a PEM file, so each CA has a file of its own in `/etc/swanctl/x509ca`;
+road-warrior and site-to-site name their CA in `cacerts`, which restricts the trust chain to it.
+
+Consequences: The P2S CA's certificates are accepted by road-warrior and OpenVPN only, the site-to-site CA's by
+site-to-site only. With an offline root, new issuing CAs and the root CRL need the offline step,
+and a router whose P2S CA waits has no VPN server certificate and so no P2S access. The router
+keeps the users' keys, as the OpenVPN profile embeds them.
+
+## ADR-28: CA certificates and CRLs are published at configurable endpoints, and CRLs are short-lived
+
+Status: Accepted
+
+Context: Clients outside the router, such as Windows and servers using the general-purpose CAs,
+find the issuer's certificate and the CRL through the AIA and CRL distribution point extensions,
+and cache a CRL until its next update. The router's CRLs were valid for ten years and published
+nowhere. Caddy serves files itself, and the web service already answers on the status port.
+
+Decision: `pki.publish` lists the endpoints, in the order the URLs appear in the certificates:
+plain HTTP on the status port, served by the web service; plain HTTP on port 80, HTTPS on the
+status HTTPS port and HTTPS on port 443, served by Caddy's `file_server`. The files are DER, as
+RFC 5280 asks of these URLs, copied to `/var/lib/vpn-router/pki-publish`, outside the 0700 PKI
+directory, so that Caddy's user reads them. Ports 80 and 443 serve only the CA files and are opened
+on both interfaces when chosen. The CRLs of the issuing CAs are valid for `pki.crl_days`, a week
+by default, signed again at every revocation and by a daily timer once half their validity has
+passed; the root CRL has its own `pki.root_crl_days`, half a year by default, so an offline root
+needs its CRL signed twice a year, not weekly.
+
+Consequences: A client that caches a CRL sees a revocation within a week. The URLs are fixed in a
+certificate when it is signed, so a change of the endpoints or of `wan.local_fqdn` applies to
+certificates signed afterwards. HTTPS URLs are offered for clients that cannot use plain HTTP,
+although a client checking the revocation of the HTTPS server's own certificate cannot use them;
+Caddy's certificate is Let's Encrypt's, so the router's endpoints do not depend on themselves.
+
+## ADR-29: Site-to-site connections authenticate with a pre-shared key or certificates
+
+Status: Accepted
+
+Context: Site-to-site connections used pre-shared keys only. Peers that are routers of this
+package, or have a PKI of their own, can authenticate with certificates, which leaves no shared
+secret to distribute. Azure's VPN gateway authenticates site-to-site connections with pre-shared
+keys only.
+
+Decision: A connection's `auth` is `psk`, the default, or `certificate`. With `certificate` the
+router presents one site-to-site certificate of its `s2s` CA, whose names are `wan.local_fqdn` and
+the local identities the connections with `certificate` use, the public or the internal address of
+their `local_id_mode`, and no address no connection presents, such as an internal address the peers
+never see; the peer's
+certificate must name the connection's `id` and be issued by the router's `s2s` CA or, when the
+connection has `remote_ca`, by that CA, its PEM certificate kept in the connection and copied to
+`/etc/swanctl/x509ca/s2s-<name>.pem`. A peer without a PKI gets its certificate from the router.
+
+Consequences: The connection Azure's gateway needs stays `psk`, so the platform writes nothing
+new. The router's site-to-site certificate is issued again when the set of names it needs changes,
+such as when a connection's `local_id_mode` or its address changes. The
+router does not check a remote CA's revocations unless strongSwan can fetch the CRL its
+certificates name.
+
+## ADR-30: A general-purpose issuing CA can back an ACME server of Caddy
+
+Status: Accepted
+
+Context: Servers that use a general-purpose CA need their certificates renewed, which ACME clients
+automate. Caddy, which the router runs for HTTPS, has an ACME server built on a CA of its `pki`
+app. Caddy 2.6.2 of the Ubuntu archive needs the key file of that CA's root, never renews an
+intermediate given to it, keeps no CRL and takes only the CA in the `acme_server` directive,
+issuing certificates valid for 12 hours. Its ACME handler answers every path under `/acme/`.
+
+Decision: An issuing CA of `pki.issuing_cas` with `acme` makes Caddy serve an ACME server for it
+at `/acme/<name>/` of the HTTPS status port, each in a `handle` block of its own. The issuing CA's
+certificate and key are given to Caddy as both the root and the intermediate of a `pki` CA, copied
+to `/etc/caddy/vpn-router-pki/<name>/` for Caddy's group, so that the router's root key never
+reaches Caddy and may be offline.
+
+Consequences: The certificates Caddy issues chain to the router's root through the issuing CA, are
+not in the router's inventory, follow no template and are not revoked; their short lifetime takes
+the place of revocation. An issuing CA waiting for the offline root has no ACME server.
+
+## ADR-31: vpn-router-setup installs Caddy from the Ubuntu archive or from Caddy's repository
+
+Status: Accepted
+
+Context: Caddy 2.6.2 of the Ubuntu archive lacks later features, such as a pki root without its key
+and the settings of the ACME server. Caddy's own repository has current versions of the package of
+the same name. A dependency on `caddy` installs the archive's package with `vpn-router`. apt cannot
+run inside `vpn-router-setup` when the package's installation runs setup, as dpkg holds its lock.
+
+Decision: `vpn-router` only suggests `caddy`. While HTTPS is on, setup has
+`vpn-router-caddy.service` install it from `https.caddy_source`: `ubuntu`, or `upstream`, for
+which the unit writes the deb822 source and the key it downloads over HTTPS from Caddy's
+repository. The unit waits for dpkg's lock and runs setup again when Caddy is in place.
+`vpn-router-caddy use-upstream` switches an installed router. Upstream's versions sort above the
+archive's, so once the repository is configured apt keeps upstream's Caddy without a pin, and
+`ubuntu` has no effect; nothing downgrades Caddy on its own, as a downgrade may break the
+configuration and is the administrator's decision. Only the CLI switches the source; the Router
+Manager shows which one is in effect.
+
+Consequences: The first setup run with HTTPS starts the installation and serves HTTPS on the run
+that follows it. The key of Caddy's repository is trusted as downloaded over HTTPS, the way Caddy's
+installation instructions do it. Going back to the archive's Caddy is a manual downgrade.
+
+## ADR-32: The PKI is kept in the router's directory
+
+Status: Accepted
+
+Context: The CAs, their keys and CRLs, the inventory of the certificates issued and their
+revocations, and the router's and the users' certificates and keys need a store. Files with a
+JSON state file cannot be searched, and are copied apart from the users the certificates belong
+to. The router runs slapd, which holds the users and is provisioned on every
+configured router (ADR-10), and PostgreSQL, which holds the refresh tokens and the metrics, may
+be another server (`web.database`) and is in a backup only with `backup.metrics`. RFC 4523
+defines `pkiCA` with `cACertificate` and `certificateRevocationList`, and `userCertificate`, which
+OpenLDAP's core schema includes.
+
+Decision: The PKI is held in `ou=pki` of the router's directory. A CA is an entry of the package's
+class `vpnRouterAuthority` with `cACertificate` and `certificateRevocationList`, its key, its CSR,
+its CRL number, the source of the root CRL and the time it was retired; a certificate is an entry
+of `vpnRouterCertificate` named by its serial number under its CA, with `userCertificate`, its
+kind, template, names, expiry and revocation, and the key of a router or user certificate. A
+user's certificate is also the `userCertificate` of the user's entry. An ACL lets no account read
+`vpnRouterPrivateKey`; only root, the database's root DN, does, through the local socket. A
+retired CA keeps its entry, renamed, so its certificates stay in the inventory. A root supplied
+from outside, by cloud-init or by hand, is placed as files before the first setup with a platform,
+which imports and removes them. strongSwan, OpenVPN, Caddy and the system's trust store read files,
+so setup and every revocation write them from the directory. Setup provisions the directory before
+the PKI; without the directory it leaves the PKI and its files as they are and configures the rest.
+
+Consequences: `slapcat` writes the users and the PKI into every backup in one consistent copy, and a
+restore brings both back together. The PKI depends on slapd, as the users already do, and not on
+PostgreSQL. The directory holds the CA keys, so it is as sensitive as the CA itself. The schema
+grows by the package's PKI attributes and classes, which setup adds to slapd's configuration.
+
+## ADR-33: The web service opens a shell for the Router Manager over a WebSocket
+
+Context: The Router Manager's Shell page gives an administrator a terminal on the router in the
+browser, with xterm.js, the terminal of VS Code. A terminal needs a full-duplex channel, which
+xterm.js expects as a WebSocket. The web service runs in a sandbox (`NoNewPrivileges`,
+`ProtectSystem=strict`, `ProtectHome`) that a shell must not inherit, and as root, which a shell
+in a browser should not be. A stolen session cookie or access token alone must not give a shell.
+
+Decision: `/shell` of the web service is off until `web.shell` is set on the router; the Router
+Manager cannot set it. The shell runs as the console account of the signed-in user (ADR-34), so
+it is never root and each administrator's shell is the administrator's own; a user without
+console login gets none. `POST /shell` signs the user in again with the password
+and TOTP code and gives a one-time ticket valid 30 seconds; a WebSocket on `GET /shell` with that
+ticket gets the shell. The WebSocket of RFC 6455 is implemented on the standard library inside the
+web service's `http.server`, server side only, without extensions. `systemd-run --pty` starts the
+shell in a transient unit with a PAM login session, outside the sandbox, and `setsid --ctty`
+makes the terminal its controlling terminal so window sizes reach the shell. A shell idle for
+`web.shell_idle_minutes` is closed, and the journal records every opening, end and refusal. The Router
+Manager checks the session and the WebSocket's origin, and relays the bytes to the router after
+both handshakes.
+
+Consequences: Who can sign in as a member of `admins` and knows the password and the current code
+can get a shell when the router allows one and the user's console login is on; a session alone
+cannot. The ticket travels in the URL and appears in request logs, used up. The shell's sessions
+show up as `vpn-router-shell-<id>` units and logind sessions of the console account. The shell's
+traffic is as protected as the Router Manager's: HTTPS to Caddy, plain HTTP on the internal
+network to the web service.
+
+## ADR-34: Console login maps an administrator to a POSIX account
+
+Context: A shell, SSH and sudo need a POSIX account. One shared system account for every
+administrator hides who did what and shares one set of rights. The administrators are users of
+the router's directory, with their passwords, TOTP tokens and lockout there; a second set of
+local accounts would duplicate them. slapd listens on its local socket only. SSSD authenticates
+only over TLS or LDAPS and has no `ldapi://`; nslcd talks `ldapi://` and checks a password by
+binding as the user.
+
+Decision: Console login is a property of a member of `admins`, `vpnRouterConsoleLogin`, that
+only root on the router sets, as for the group `admins`. It runs the console as an existing local
+account (`vpnRouterConsoleAccount`), or as the user's own POSIX account: the user's entry becomes a
+`posixAccount` with a uid from 20000 up and the local group `vpn-router-console` as its group.
+nslcd serves the POSIX accounts with console login on, and PAM checks their passwords with a bind,
+so slapd's otp overlay and password policy apply as for the Router Manager: the password followed
+by the code, and the lockout. Members of `vpn-router-console` get sudo with that password. SSH
+accepts it only while `ssh.ldap_login` is set, in a `Match Group` drop-in of sshd. Switching console
+login off keeps the `posixAccount`, hidden by nslcd's filter, so the uid and the home stay the
+user's; leaving `admins` switches it off.
+
+Consequences: Each administrator's shell, SSH session and sudo run as the administrator, logged
+under the administrator's name. The directory becomes part of the system's name service through
+nslcd, and the system knows only the accounts with console login on. A user enrolled for TOTP types
+the code after the password at the SSH and sudo prompts. Homes are created at the first login and
+are not removed with the user. A password is changed through the directory, not with `passwd`.
+
+## ADR-35: WireGuard peers are the devices of the VPN users, kept in the directory
+
+Context: The WireGuard endpoint could be switched on from the Router Manager, but its peers were
+written by hand into `wg0.conf`, so nobody could connect without SSH. A peer is a P2S client like
+an OpenVPN or IKEv2 user, and one person may have several devices.
+
+Decision: A VPN user's entry holds the user's WireGuard peers in the multi-valued attribute
+`vpnRouterWireGuardPeer`, one value `<public key> <IP>[,<IP>...]` per device; the router never
+sees a private key. `PUT /users/<name>` replaces a user's peers after checking the keys, which
+are unique, and the IPs, which do not overlap another peer's or cover the router's address. Setup
+reads the peers of the users who are not disabled from the directory and writes them as a marked
+block of `[Peer]` sections into `wg0.conf`; sections outside the block, added by hand, stay. A
+change of the peers, and disabling, enabling or removing a user with peers, restart setup. The
+Router Manager adds and removes peers on the WireGuard tab of Remote access management, where the
+endpoint is, choosing the user for each.
+
+Consequences: Peers follow their users: disabling a user drops the user's devices, and the
+directory's backup holds them. A peer cannot exist without a VPN user. A change restarts
+`wg-quick@wg0` through setup, which briefly interrupts the other peers.

README.md

@@ -2,8 +2,11 @@
 
 A Debian package that configures a Linux host or virtual machine as a VPN router:
 
-- site-to-site IKEv2 IPSec with pre-shared key authentication (strongSwan swanctl)
-- road-warrior (P2S) access using IKEv2 EAP-TLS, with a bundled certificate authority
+- site-to-site IKEv2 IPSec with pre-shared key or certificate authentication (strongSwan swanctl)
+- road-warrior (P2S) access using IKEv2 EAP-TLS
+- a two-level certificate authority: a root, which may be kept offline, and issuing CAs for the VPN
+  clients, for site-to-site and for general use, with certificate templates, published certificates
+  and CRLs, and an optional ACME server
 - OpenVPN (P2S) access with a certificate and a password per user, the users kept in a local
   LDAP directory and managed with `vpn-router-user` or the web service
 - optional WireGuard endpoint
@@ -110,9 +113,8 @@ must have the type shown below; an unknown section or setting is an error.
 | `site_to_site` | | object | | The site-to-site connections, each a name and an object of the settings below |
 | `p2s` | `enabled` | boolean | `false` | Road-warrior access |
 | `p2s` | `address_pool` | string | | CIDR assigned to road-warrior clients |
-| `p2s` | `ca_name` | string | `VPN Router CA` | Common name for a locally created CA |
 | `wireguard` | `enabled` | boolean | `false` | WireGuard endpoint |
-| `wireguard` | `address` | string | | Address and prefix for `wg0`, for example `192.168.200.1/24` |
+| `wireguard` | `address` | string | | The router's own address on `wg0` with the prefix of the peers' network, for example `192.168.200.1/24`; the network and the broadcast address of a network larger than /31 are refused |
 | `wireguard` | `listen_port` | integer | `51820` | UDP port |
 | `openvpn` | `enabled` | boolean | `false` | OpenVPN access for users |
 | `openvpn` | `address_pool` | string | | IPv4 CIDR assigned to OpenVPN clients |
@@ -126,10 +128,27 @@ must have the type shown below; an unknown section or setting is an error.
 | `web` | `database` | string | | A PostgreSQL connection string for the refresh tokens; without it, the `vpn-router` database on this host that the web service creates |
 | `web` | `trusted_proxies` | list | the address the call came in on | Addresses whose `X-Forwarded-For` header names the client for the `/auth` rate limit and the Client IP of the status |
 | `web` | `status_content` | string | `basic` | What `/` and `/status` show: `basic`, `standard` or `full` (see Status web service) |
+| `web` | `shell` | boolean | `false` | `/shell` opens a login shell for a member of `admins` with console login (see The shell) |
+| `web` | `shell_idle_minutes` | integer | `15` | Minutes without a keystroke after which a shell is closed, 1 to 1440 |
+| `ssh` | `ldap_login` | boolean | `false` | sshd accepts the directory password of the console accounts in the directory (see Console login and SSH) |
 | `https` | `enabled` | boolean | `true` | Caddy serves the status web service and the Router Manager over HTTPS for `wan.local_fqdn` |
 | `https` | `email` | string | | The e-mail address of the Let's Encrypt account |
 | `https` | `web_port` | integer | `7444` | HTTPS port of the status web service |
 | `https` | `manager_port` | integer | `7443` | HTTPS port of the Router Manager |
+| `https` | `caddy_source` | string | `ubuntu` | Where Caddy is installed from: `ubuntu`, the Ubuntu archive, or `upstream`, Caddy's own repository (see HTTPS) |
+| `pki` | `root_name` | string | `VPN Router Root CA` | Common name of the root CA, when the router creates it |
+| `pki` | `root_days` | integer | `7300` | Days the root CA's certificate is valid |
+| `pki` | `ca_days` | integer | `3650` | Days an issuing CA's certificate is valid |
+| `pki` | `key` | string | `rsa-4096` | Key of the root and the issuing CAs: `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256` or `ec-p384` |
+| `pki` | `crl_days` | integer | `7` | Days the CRLs of the issuing CAs are valid |
+| `pki` | `root_crl_days` | integer | `180` | Days the root CRL is valid, when the router signs it |
+| `pki` | `publish` | list | `http` | Where the CA certificates and CRLs are published: `http`, `http-80`, `https`, `https-default` (see Certificates) |
+| `pki` | `p2s_name` | string | `VPN Router P2S CA` | Common name of the P2S issuing CA |
+| `pki` | `s2s_name` | string | `VPN Router Site-to-Site CA` | Common name of the site-to-site issuing CA |
+| `pki` | `issuing_cas` | object | | The general-purpose issuing CAs, each a name and `{name, templates, acme}` (see Certificates) |
+| `pki` | `templates` | object | | Certificate templates, each a name and the options it changes or defines (see Certificates) |
+| `pki` | `extended_key_usages` | object | | Custom extended key usages templates may give, each a name and its OID in dotted form (see Certificates) |
+| `pki` | `root_key_warning` | boolean | `true` | `vpn-router-ca status` and `/ca` warn while the root key is on the router; `false` silences that warning |
 | `metrics` | `enabled` | boolean | `true` | The metrics service: collection, history and `/metrics` |
 | `metrics` | `listen` | string | `internal` | The interfaces `/metrics` is served on: `internal`, `external` or `both` |
 | `metrics` | `port` | integer | `9464` | TCP port of `/metrics` |
@@ -143,6 +162,23 @@ must have the type shown below; an unknown section or setting is an error.
 | `metrics` | `keep_daily` | string | `3 months` | How long the daily summaries are kept |
 | `metrics` | `keep_monthly` | string | `1 year` | How long the monthly summaries are kept |
 | `metrics` | `keep_yearly` | string | `10 years` | How long the yearly summaries are kept |
+| `backup` | `enabled` | boolean | `false` | Scheduled backups (see Backups) |
+| `backup` | `schedule` | string | `daily` | `hourly`, `daily` or `weekly` |
+| `backup` | `target` | string | `local` | `local`, an archive in `backup.path`, or `pbs`, a Proxmox Backup Server |
+| `backup` | `path` | string | `/var/backups/vpn-router` | The folder of local archives, an absolute path |
+| `backup` | `keep_hourly` | integer | `24` | Hourly local archives kept, with the hourly schedule |
+| `backup` | `keep_daily` | integer | `7` | Daily local archives kept, with the hourly and the daily schedule |
+| `backup` | `keep_weekly` | integer | `4` | Weekly local archives kept |
+| `backup` | `keep_monthly` | integer | `12` | Monthly local archives kept |
+| `backup` | `keep_yearly` | integer | `0` | Yearly local archives kept |
+| `backup` | `metrics` | boolean | `false` | The backup holds the database of the metrics and the refresh tokens |
+| `backup` | `rclone_remote` | string | | `remote:path` of `/etc/vpn-router/rclone.conf` the local archives are copied to |
+| `backup` | `rclone_mode` | string | `sync` | `sync` mirrors the archives, `copy` deletes nothing in the cloud |
+| `backup` | `pbs_repository` | string | | `user@realm!token@host[:port]:datastore` |
+| `backup` | `pbs_password` | string | | The secret of the API token |
+| `backup` | `pbs_fingerprint` | string | | The SHA-256 fingerprint of the server's certificate, when the system's CAs do not verify it |
+| `backup` | `pbs_namespace` | string | | The namespace of the datastore, such as `routers/azure` |
+| `backup` | `pbs_keyfile` | string | | An encryption key of `proxmox-backup-client key create`, an absolute path |
 
 ### Site-to-site connections
 
@@ -159,13 +195,23 @@ of the status web service, which the Router Manager uses.
 | `cidrs` | list | | Remote subnets reachable through the tunnel |
 | `local_cidrs` | list | | Local subnets advertised into the tunnel |
 | `local_id_mode` | string | `fqdn` | The router's IKE identity: `fqdn` is `wan.local_fqdn`, `public_ip` the address it resolves to, `internal_ip` the internal address |
-| `psk` | string | | Pre-shared key |
+| `auth` | string | `psk` | How both sides authenticate: `psk`, a pre-shared key, or `certificate` |
+| `psk` | string | | Pre-shared key, with `auth` `psk` |
 | `psk_file` | string | | Path to a file holding the key; wins over `psk` |
+| `remote_ca` | string | | With `auth` `certificate`, the PEM certificate of the CA that issued the peer's certificate; without it the router's site-to-site CA |
 
-A connection is set up once all of `addrs`, `id`, `cidrs`, `local_cidrs`, the key and its
-local identity are known; all such connections are written to
-`/etc/swanctl/conf.d/site-to-site.conf`. Traffic from a connection's `local_cidrs` to its
-`cidrs` is not masqueraded.
+A connection is set up once all of `addrs`, `id`, `cidrs`, `local_cidrs` and its local
+identity are known, with `psk` the key, and with `certificate` the router's site-to-site
+certificate; all such connections are written to `/etc/swanctl/conf.d/site-to-site.conf`.
+Traffic from a connection's `local_cidrs` to its `cidrs` is not masqueraded.
+
+With `auth` `certificate`, the router authenticates with its site-to-site certificate, which the
+site-to-site issuing CA signs for `wan.local_fqdn` and for the public or the internal address
+that a connection with `auth` `certificate` uses as its identity (`local_id_mode` `public_ip` or
+`internal_ip`); it is issued again when that set of names changes. The peer's certificate must name `id` and be issued
+by the router's site-to-site CA, or by the CA of `remote_ca`. A peer with no PKI of its own gets
+its certificate from the router (template `site-to-site`, see Certificates), with the root and
+the site-to-site CA certificates as its trust anchors.
 
 A minimal site-to-site configuration in `auto` mode:
 
@@ -191,9 +237,17 @@ an FQDN or an IPv4 or IPv6 address. They are written to the strongSwan configura
 strongSwan reads an address as an IP identity and a name as an FQDN, so a leading `@` is not needed
 and is refused. Road-warrior and OpenVPN access need a name in `wan.local_fqdn`.
 
-WireGuard peers are added by hand in `/etc/wireguard/wg0.conf`. The package owns the
-`[Interface]` section of that file and rewrites it when the settings above change, but it
-carries every `[Peer]` section across untouched.
+WireGuard peers are P2S users' devices: a VPN user of the router's directory may have up to 16
+peers, each with its public key and its IPs, IPv4 addresses or networks, kept in the user's
+entry (`vpnRouterWireGuardPeer`) and set with `PUT /users/<name>` (`wireguard_peers`) or on the
+WireGuard tab of the Router Manager's Remote access management. A key is used by one peer only,
+the IPs of two peers may not overlap, and no peer's IPs cover the router's own address of
+`wireguard.address`. The package owns the `[Interface]` section of `/etc/wireguard/wg0.conf` and,
+between the lines `# BEGIN` and `# END WireGuard peers of the users of the router's directory`, a
+`[Peer]` section for each peer of a user who is not disabled; setup rewrites them when the
+settings or the peers change, and a change of a user's peers, disabling, enabling or removing a
+user with peers restarts setup. Every other `[Peer]` section, added by hand, is carried across
+untouched. While the directory cannot be reached, the users' peers in the file stay as they are.
 
 Every feature is independent. Leaving a group empty simply means that feature is not
 configured, and its generated files are removed.
@@ -324,57 +378,236 @@ anything:
 ```
 
 This does still write to the system: it renders into `/etc/swanctl/`,
-`/etc/systemd/resolved.conf.d/` and `/etc/wireguard/`, and if road-warrior access is
-enabled with an empty PKI directory it creates the certificate authority and adds it
-to the host trust store. What it leaves alone is routes, firewall rules and services -
-that is what `systemctl restart vpn-router-setup` adds.
+`/etc/systemd/resolved.conf.d/` and `/etc/wireguard/`, creates what the PKI is missing and
+adds the root CA to the host trust store. What it leaves alone is routes, firewall rules and
+services - that is what `systemctl restart vpn-router-setup` adds.
 
 ## Certificates
 
-`/etc/vpn-router/pki` is the PKI directory, laid out the way `simple-ca` expects:
+The router has a two-level certificate authority, kept by `vpn-router-setup` and managed with
+`vpn-router-ca`, `vpn-router-user` and `/ca` of the status web service, which the Router Manager
+uses. It is held in `ou=pki,dc=vpn-router,dc=local` of the router's directory, next to the users:
 
 ```
-ca_cert.pem  ca_key.pem  ca_bundle.pem  <label>_cert.pem  <label>_key.pem  crl.pem
+cn=root                       the root CA; without vpnRouterPrivateKey while the root is offline
+cn=<name>                     an issuing CA; with vpnRouterCertificateRequest while it waits for the offline root
+cn=<name>-<time>              an issuing CA taken out of use, with vpnRouterRetired
+serialNumber=<serial>,cn=<CA> a certificate the CA issued
 ```
 
-`<label>` is the first component of the router FQDN, so `router.example.com` gives
-`router_cert.pem`.
-
-Once a platform is chosen and while this directory is empty, a certificate authority and a CRL
-valid for ten years are created there automatically, whether or not road-warrior or OpenVPN
-access is enabled. A CA of the router's own (with `ca_key.pem`) without a CRL gets one, and
-without a server certificate gets one once `wan.local_fqdn` is set. User certificates are issued
-by `vpn-router-user` into `users/`. To use your own CA instead, place the files in that layout
-before choosing the platform; nothing present is overwritten.
-
-Either way, the package copies what each consumer needs into place: the CA into
-`/etc/swanctl/x509ca/`, the server certificate and key into `/etc/swanctl/x509/` and
-`/etc/swanctl/private/`, a CRL into `/etc/swanctl/x509crl/`, and the CA into the system
-trust store.
-
-Issue a client certificate with the bundled tool:
+A CA entry (class `vpnRouterAuthority`) has its certificate (`cACertificate;binary`), key, CRL
+(`certificateRevocationList;binary`) and CRL number. A certificate entry (class
+`vpnRouterCertificate`) has the certificate (`userCertificate;binary`), its kind (`ca`, `router`,
+`user` or `external`), template, names, expiry and revocation, and for the router's and the users'
+certificates the key. A user's certificate is also the `userCertificate` of the user's entry. No
+account of the directory reads a key (`vpnRouterPrivateKey`); only root does, through the local
+socket. `slapcat` writes the whole PKI into every backup with the users.
 
 ```sh
-/usr/lib/vpn-router/simple-ca make-cert --ca-dir /etc/vpn-router/pki alice
-/usr/lib/vpn-router/simple-ca make-pfx  --ca-dir /etc/vpn-router/pki \
-    --password s3cr3t /etc/vpn-router/pki/alice_cert.pem
+ldapsearch -Q -Y EXTERNAL -H ldapi:/// -b ou=pki,dc=vpn-router,dc=local -s one cn
 ```
 
-`simple-ca` comes from a separate project, <https://gitea.koszewscy.waw.pl/slawek/simple-ca>,
-and also supports `make-crl` and `revoke-cert`.
+### The CAs
+
+The root signs the issuing CAs only (path length 1), and the issuing CAs sign the certificates
+(path length 0):
+
+- `p2s`, named `pki.p2s_name`, signs the router's VPN server certificate, which IKEv2 and OpenVPN
+  present, and the users' certificates. Road-warrior and OpenVPN accept client certificates of
+  this CA only.
+- `s2s`, named `pki.s2s_name`, signs the router's site-to-site certificate and the certificates
+  of its peers.
+- The general-purpose CAs of `pki.issuing_cas`, each a name and `{"name": common name,
+  "templates": [...], "acme": false}`. The name starts with a lowercase letter, has at most 31
+  lowercase letters, digits and hyphens, and is not `root`, `p2s` or `s2s`; `templates` are the
+  templates the CA issues.
+
+Once a platform is chosen, `vpn-router-setup` creates what is missing: the root when it has
+neither certificate nor key, each issuing CA, the router's certificates once `wan.local_fqdn` is
+set, and the CRLs. The names, lifetimes and key type of `pki` apply when something is created. An
+issuing CA removed from `pki.issuing_cas` is retired: its entry is renamed `cn=<name>-<time>`,
+loses its key, and its certificate is revoked on the root CRL. The router renews its own certificates when less than a
+third of their lifetime is left, when the names they need change, or when their CA changes; a
+user's certificate is renewed by removing and adding the user.
+
+The package copies what each consumer needs: the root, `p2s` and `s2s` into
+`/etc/swanctl/x509ca/` as `root.pem`, `p2s.pem` and `s2s.pem` (strongSwan reads one certificate
+per file), the remote CA of each site-to-site connection that has one as `s2s-<name>.pem`, the
+router's certificates into `/etc/swanctl/x509/` and their keys into `/etc/swanctl/private/`, the
+CRLs into `/etc/swanctl/x509crl/`, the root and `p2s` with their CRLs into
+`/etc/openvpn/server/vpn-router-ca.pem` and `vpn-router-crl.pem`, and the root into the system
+trust store.
+
+`vpn-router-ca status` shows the root, the issuing CAs and what needs attention:
+
+```sh
+vpn-router-ca status
+vpn-router-ca list --ca p2s
+```
+
+### Templates
+
+A template says what a certificate holds:
+
+| Option | Type | Default | Meaning |
+|---|---|---|---|
+| `key` | string | `rsa-3072` | `rsa-2048`, `rsa-3072`, `rsa-4096`, `ec-p256` or `ec-p384`, for a key the router makes |
+| `days` | integer | `365` | Days the certificate is valid, at most until its CA's certificate expires |
+| `key_usage` | list | `digital_signature` | Of `digital_signature`, `content_commitment`, `key_encipherment`, `data_encipherment`, `key_agreement` |
+| `extended_key_usage` | list | | Of the built-in `server_auth`, `client_auth`, `code_signing`, `email_protection`, `time_stamping`, `ocsp_signing`, `ipsec_ike`, `ike_intermediate`, and the custom usages of `pki.extended_key_usages` |
+| `policies` | list | | Certificate policy OIDs in dotted form, written into a Certificate Policies extension |
+| `subject` | string | `name` | The common name: `dns`, a DNS name, which is also a subject alternative name; `name`, any name; `email`, an e-mail address |
+| `sans` | list | | The subject alternative names allowed: of `dns`, `ip`, `email` |
+
+The built-in templates:
+
+| Template | Key usage | Extended key usage | Subject | Names | Issued by |
+|---|---|---|---|---|---|
+| `vpn-server` | digital signature, key encipherment | server auth, IKE intermediate | `dns` | `dns`, `ip` | `p2s`, for the router only |
+| `vpn-user` | digital signature | client auth | `name` | `dns`, `email` | `p2s`, for the users only |
+| `site-to-site` | digital signature, key encipherment | server auth, client auth | `dns` | `dns`, `ip` | `s2s` |
+| `server` | digital signature, key encipherment | server auth | `dns` | `dns`, `ip` | general-purpose CAs |
+| `client` | digital signature | client auth | `name` | `dns`, `email` | general-purpose CAs |
+
+`pki.templates` changes options of the built-in templates, which cannot be removed, and adds
+templates of its own, named like the issuing CAs:
+
+```json
+"pki": {
+  "issuing_cas": { "servers": { "name": "Example Server CA", "templates": ["server", "web", "smartcard"] } },
+  "extended_key_usages": { "smartcard_logon": "1.3.6.1.4.1.311.20.2.2" },
+  "templates": {
+    "server": { "days": 397 },
+    "web": { "key": "ec-p256", "days": 90, "key_usage": ["digital_signature"],
+             "extended_key_usage": ["server_auth"], "subject": "dns", "sans": ["dns"] },
+    "smartcard": { "key_usage": ["digital_signature", "key_encipherment"],
+                   "extended_key_usage": ["client_auth", "smartcard_logon"], "subject": "name",
+                   "sans": ["email"], "policies": ["1.3.6.1.4.1.99999.1.1"] }
+  }
+}
+```
+
+A custom extended key usage is first added to `pki.extended_key_usages`, a name of at most 31
+lowercase letters, digits, hyphens and underscores that is not a built-in one, and its OID; a
+template then gives it by its name. A usage a template gives cannot be removed. `policies` puts
+the OIDs of the issuance policies a certificate is issued under into its Certificate Policies
+extension, without qualifiers.
+
+### Issuing and revoking
+
+```sh
+vpn-router-ca issue --ca servers --template server --csr web.csr > web.pem
+vpn-router-ca issue --ca servers --template server --subject web.example.com --san 10.0.0.5 --pfx web.pfx
+vpn-router-ca revoke 5F0A12C3D4 --reason key_compromise
+```
+
+With a CSR, the certificate is for the CSR's key, common name and subject alternative names,
+checked against the template, and the certificate and the chain (issuing CA, root) are printed.
+Without one, the router makes a key as the template says and writes a PKCS#12 file with the key,
+the certificate and the chain, protected by the password read from the first line of standard
+input; the router keeps the certificate and not the key. `vpn-server` and `vpn-user` are issued by
+the router only.
+
+`revoke` takes the serial number `list` shows and a reason: `unspecified`, `key_compromise`,
+`affiliation_changed`, `superseded`, `cessation_of_operation` or `privilege_withdrawn`. A user's
+certificate is revoked by removing the user, and an issuing CA by removing it from
+`pki.issuing_cas`; a revoked router certificate is issued again by `vpn-router-setup`.
+
+### Published certificates and CRLs
+
+Every certificate names its issuer's certificate (AIA) and CRL (CRL distribution point) at each
+endpoint of `pki.publish`, in that order. They are served, without authentication, as DER at
+`/pki/<name>.crt` and `/pki/<name>.crl`, the root as `root`, from copies in
+`/var/lib/vpn-router/pki-publish`:
+
+| Endpoint | URL | Served by |
+|---|---|---|
+| `http` | `http://<wan.local_fqdn>:<web.port>/pki/` | the status web service; needs `web.enabled` |
+| `http-80` | `http://<wan.local_fqdn>/pki/` | Caddy, on port 80, open on both interfaces; needs `https.enabled` |
+| `https` | `https://<wan.local_fqdn>:<https.web_port>/pki/` | Caddy; needs `https.enabled` |
+| `https-default` | `https://<wan.local_fqdn>/pki/` | Caddy, on port 443, open on both interfaces; needs `https.enabled` |
+
+The URLs are written into a certificate when it is signed, so a change of `pki.publish` or of the
+names applies to the certificates signed afterwards. An empty `pki.publish` leaves the extensions
+out.
+
+The CRLs of the issuing CAs are valid for `pki.crl_days`, and the root CRL, when the router signs
+it, for `pki.root_crl_days`. A CRL is signed again at every revocation and, once half of its
+validity has passed, by `vpn-router-pki.timer`, which runs `vpn-router-ca maintain` daily; it also
+has `vpn-router-setup` renew the router's certificates when they are due. OpenVPN checks the CRL
+of every CA of a client's chain, the root's included, and refuses every client while one has
+expired.
+
+### Offline root
+
+Keeping the root key off the router is recommended, not required; while it is on the router,
+`vpn-router-ca status` says so, unless `pki.root_key_warning` is `false`. Export it, encrypted with a
+passphrase read from the first line of standard input, keep the file in a safe place, and remove
+the key from the router:
+
+```sh
+vpn-router-ca root export-key --out /root/vpn-router-root-key.pem
+vpn-router-ca root remove-key
+```
+
+While the root key is not on the router, a new issuing CA gets its key and a CSR and waits;
+`vpn-router-ca status` says so. Print the CSR and the extensions to sign it with, sign it with the
+root on the offline machine, and import the certificate:
+
+```sh
+vpn-router-ca ca csr servers          # the CSR, then the [ issuing_ca ] extensions
+# on the offline machine, with the CSR in servers.csr and the extensions in issuing_ca.cnf:
+openssl x509 -req -in servers.csr -CA root-cert.pem -CAkey vpn-router-root-key.pem -CAcreateserial \
+    -days 3650 -sha256 -extfile issuing_ca.cnf -extensions issuing_ca -out servers.pem
+vpn-router-ca ca import servers servers.pem
+```
+
+The router cannot sign the root CRL without the key. Sign it where the key is, or put the key back
+for a moment, and take the CRL before the current one expires:
+
+```sh
+vpn-router-ca root import-key /root/vpn-router-root-key.pem   # the passphrase on standard input
+vpn-router-ca maintain
+vpn-router-ca root remove-key
+# or, with a CRL signed elsewhere:
+vpn-router-ca root import-crl root.crl
+```
+
+An existing root CA of your own is used by placing its certificate, and its key if the router may
+use it, as `/etc/vpn-router/pki/root/cert.pem` and `key.pem` before `vpn-router-setup` first runs
+with a platform, as cloud-init can. Setup imports them into the directory and removes the files.
+Without the key, the issuing CAs wait for their certificates as above.
+
+### ACME server
+
+A general-purpose CA with `"acme": true` backs an ACME server of Caddy, while `https.enabled`, at
+`https://<wan.local_fqdn>:<https.web_port>/acme/<name>/directory`, so servers get and renew
+certificates with any ACME client:
+
+```sh
+certbot certonly --standalone -d web.example.com \
+    --server https://router.example.com:7444/acme/servers/directory
+```
+
+Caddy proves the client's control of the name as Let's Encrypt does, so it must reach the client.
+The certificates are valid for 12 hours, carry Caddy's extensions, are not listed by
+`vpn-router-ca list`, cannot be revoked, and no template applies to them. Caddy reads the CA's
+certificate and key from `/etc/caddy/vpn-router-pki/<name>/`, readable by its group.
 
 ## OpenVPN and users
 
 With `openvpn.enabled`, an `address_pool` and `wan.local_fqdn` set, `vpn-router-setup` runs
 `openvpn-server@vpn-router` with `/etc/openvpn/server/vpn-router.conf`. The server uses the
-router's CA, certificate and CRL (the copies under `/etc/swanctl`), pushes routes to
-`local.cidrs` and the router as DNS server, and opens `openvpn.port` on the external interface.
+router's VPN server certificate, the root and the P2S CA and their CRLs (see Certificates),
+pushes routes to `local.cidrs` and the router as DNS server, and opens `openvpn.port` on the
+external interface.
 
-A client needs both a certificate of the router CA and the password of the user the
+A client needs both a certificate of the P2S CA and the password of the user the
 certificate names:
 
-- the certificate is checked against the CA and the CRL (`crl-verify`, read at every
-  connection);
+- the certificate is checked against the root and the P2S CA and their CRLs (`crl-verify`, read
+  again when the file changes), and `/usr/lib/vpn-router/openvpn-issuer` (`tls-verify`) refuses
+  a certificate another issuing CA signed;
 - the password is checked by `openvpn-auth-ldap`, which binds to the user directory as the
   user; a user enrolled for TOTP types the password followed by the current 6-digit code;
 - `/usr/lib/vpn-router/openvpn-same-user` refuses a login whose user name is not the common
@@ -393,9 +626,10 @@ is switched on:
   `account` for a Manager-only account (see Managing users);
 - the package's own schema, `cn=vpn-router,cn=schema,cn=config`, under the OID
   `2.25.98477352595735834532404256531620013001` of the UUID arc: the auxiliary class
-  `vpnRouterAccount` with `MAY ( mail $ vpnRouterScope )`, which Manager-only and service accounts
-  have, and the attribute `vpnRouterScope`, authorization scopes, of which `service` marks a
-  service account;
+  `vpnRouterAccount` with `MAY ( mail $ vpnRouterScope $ displayName $ description )`, which
+  Manager-only and service accounts have, and the attribute `vpnRouterScope`, authorization
+  scopes, of which `service` marks a service account; `displayName` and `description` are the
+  display name and the description of a service account;
 - `ou=groups` holds one `groupOfNames` per group, named by `cn`, with its members' DNs in
   `member` and an optional `description`;
 - `cn=user-manager,ou=services` is the account that changes users and groups; it may write
@@ -422,17 +656,19 @@ it is added:
 
 - a VPN user, an `inetOrgPerson` with a first name, a last name and an e-mail address
   (`givenName`, `sn` and `mail`; `cn` is the first and the last name), and a client certificate
-  with the user name as its common name, in `/etc/vpn-router/pki/users`;
+  with the user name as its common name, the entry's `userCertificate`, whose key the PKI keeps;
 - a Manager-only account, an `account`, `simpleSecurityObject` and `vpnRouterAccount` with the
   name, the password and an optional e-mail address, for notifications: no names and no
   certificate, so no VPN access. It can sign in to `/auth` and, as a member of `admins`, manage
   the router. `add` without the first and the last name adds one; its names cannot be set later;
 - a service account, a Manager-only account whose `vpnRouterScope` is `service`, which another
   system signs in with to use a router service, such as an OpenTelemetry Collector reading
-  `/metrics`; it cannot sign in to `/auth`. `add --service` adds one, and the web service manages
-  them at `/service-accounts`, not at `/users`. Internal service accounts are those the router
-  creates and manages for its own services; at present that is the metrics service's, the account
-  `metrics.service_account` names while metrics are enabled (see Metrics). The API only lists
+  `/metrics`; it cannot sign in to `/auth`. Besides its name, it has a display name and a
+  description. `add --service` adds one, and the web service manages them at `/service-accounts`,
+  not at `/users`. Internal service accounts are those the router creates and manages for its own
+  services, display name and description included; at present that is the metrics service's, the
+  account `metrics.service_account` names while metrics are enabled (see Metrics), which
+  `vpn-router-setup` names Metrics. The API only lists
   them: `/service-accounts` refuses every other request on one, and `/groups` refuses to put one
   in or take one out of a group, with 403.
 
@@ -466,8 +702,9 @@ vpn-router-user otp-remove alice
 | `list` | The users with their kind, names and e-mail addresses, whether each is enabled or locked, has a certificate and is enrolled for TOTP |
 | `add <name> --first-name F --last-name L --email E` | Adds a VPN user and issues the certificate |
 | `add <name> [--email E]` | Adds a Manager-only account, with the e-mail address when given; one name without the other two options is refused |
-| `add <name> --service [--email E]` | Adds a service account, with the e-mail address when given; the names are refused |
+| `add <name> --service [--display-name N] [--description D] [--email E]` | Adds a service account, with its display name, description and e-mail address when given; the names are refused |
 | `update <name> [--first-name F] [--last-name L] [--email E]` | Changes the names or the e-mail address |
+| `update <name> [--display-name N] [--description D] [--email E]` | Changes the display name, the description or the e-mail address of a service account; `''` removes one |
 | `passwd <name>` | Sets the password |
 | `disable <name>`, `enable <name>` | Locks the user out of OpenVPN and `/auth`, and lets the user in again |
 | `unlock <name>` | Ends a lockout after failed logins and clears the failure count; a disabled user stays disabled |
@@ -476,6 +713,7 @@ vpn-router-user otp-remove alice
 | `otp-new <name>` | A new TOTP secret and its `otpauth://` URI, issued by `wan.local_fqdn`, for an authenticator app; nothing is stored |
 | `otp-enrol <name> <code>` | Stores the secret read from standard input when the code is a current code of it, replacing a secret the user has |
 | `otp-remove <name>` | Removes the user's TOTP secret |
+| `console <name> (--posix \| --account LOCAL \| --off)` | Switches the console login of a member of `admins` on, as the user's own POSIX account or a local account, or off (see Console login and SSH) |
 
 A user name is 1 to 32 lowercase letters, digits and hyphens, starting with a letter; a
 password has 8 to 128 characters; a first or last name has 1 to 64 printable characters; an
@@ -496,6 +734,38 @@ the file.
 The certificate is also accepted by road-warrior (IKEv2 EAP-TLS) access, which checks
 certificates only, so `disable` does not affect it; `remove` revokes the certificate for both.
 
+### Console login and SSH
+
+A member of `admins` may have console login: the Router Manager's Shell page (see The shell),
+and, for the user's own POSIX account, SSH and sudo. Only root on the router switches it, with
+`vpn-router-user console` or a token of `vpn-router-token`, as for the group `admins`:
+
+```sh
+vpn-router-user console alice --posix
+vpn-router-user console bob --account azureuser
+vpn-router-user console alice --off
+vpn-config-edit set ssh.ldap_login true
+```
+
+- **Own POSIX account** (`--posix`): the user's entry becomes a `posixAccount` of the directory
+  with the user's name, a uid from 20000 up, the local group `vpn-router-console` as its group,
+  `/home/<name>` and `/bin/bash`. `nslcd` makes it known to the system over slapd's local socket
+  and checks its password by binding as the user, so a user enrolled for TOTP types the password
+  followed by a current code, failed logins count towards the lockout, and a disabled user cannot
+  sign in. The home is created at the first login and kept when the user is removed. Members of
+  `vpn-router-console` may run any command with sudo, with the same password. A local account of
+  the same name is refused.
+- **Local account** (`--account`): the console runs as an existing local account with a uid from
+  1000 to 19999, such as the VM's admin user; its SSH keys and sudo rights stay as they are.
+- **Off** (`--off`): the system no longer knows the user's own POSIX account, and its sessions
+  end; its uid is kept for the next time. Leaving `admins`, or removing or renaming the group,
+  switches the console login of the members off.
+
+While `ssh.ldap_login` is `true`, setup lets sshd accept the password of the members of
+`vpn-router-console` (`/etc/ssh/sshd_config.d/vpn-router.conf`); other accounts keep sshd's
+settings. A password change is made in the Router Manager or with `vpn-router-user passwd`, not
+with `passwd`.
+
 ### Managing groups
 
 `vpn-router-group` manages the groups. A group has a name, with the rules of a user name, an
@@ -578,7 +848,7 @@ configuration: no key, identity, subnet, or address but the client's. They show
 |---|---|
 | `basic` (default) | The overall status (`ok` or `degraded`), the time and the Client IP |
 | `standard` | Also the `vpn-router` version, the `vpn-router-manager` version or that it is not installed, and the number of active services and of services in any other state, without their names |
-| `full` | Also each service and its state, Docker, and the state of each site-to-site connection, road-warrior, OpenVPN and WireGuard |
+| `full` | Also each service and its state, Docker, how many site-to-site connections are set up and how many of them are established (`site_to_site`: `connections` and `established`, `null` when swanctl cannot be asked), road-warrior, OpenVPN and WireGuard |
 
 The Client IP is the address the request came from: the last entry of `X-Forwarded-For` for a
 request from one of `web.trusted_proxies`, by default the address the request came in on, so
@@ -623,11 +893,12 @@ The status holds the state of `vpn-router-setup`, `slapd` and each PostgreSQL cl
 `vpn-router-manager` when that package is installed, of `strongswan` when site-to-site or
 road-warrior access is configured, of `wg-quick@wg0` when WireGuard is, and of
 `openvpn-server@vpn-router` when OpenVPN is; the number of connected
-OpenVPN clients, from the server's status file, which OpenVPN rewrites every minute; the package version and,
+OpenVPN clients, from the server's status file, which OpenVPN rewrites every 5 seconds; the package version and,
 as `manager_version`, the installed version of `vpn-router-manager` (`null`, shown as not installed, without it); whether
 Docker is installed, and when it is, the state of `docker.service` and of `vpn-router-docker`
-(the Docker rules), which do not change `status`; as `site_to_site.connections`, whether each
-site-to-site connection that is set up is established (`null` when swanctl cannot be asked); the number of connected road-warrior (IPsec P2S) clients; and
+(the Docker rules), which do not change `status`; as `site_to_site`, the number of site-to-site
+connections that are set up (`connections`) and of those established (`established`, `null` when
+swanctl cannot be asked), without their names; the number of connected road-warrior (IPsec P2S) clients; and
 the WireGuard peers with the age of their last handshake and their traffic. `status` is `ok` when
 all these services are active, and `degraded` otherwise.
 
@@ -638,7 +909,7 @@ curl http://10.0.0.4:7081/status
 
 ### Tokens and signing in
 
-`/config`, `/users`, `/service-accounts`, `/groups`, `/site-to-site` and `/account` need a JWT in an `Authorization: Bearer` header, signed with
+`/config`, `/users`, `/service-accounts`, `/groups`, `/site-to-site`, `/backup`, `/remote-access`, `/ca`, `/shell` and `/account` need a JWT in an `Authorization: Bearer` header, signed with
 HS256 by the key the web service makes on its first run, `/etc/vpn-router/web.key` (root only).
 The key never leaves the router; while it does not exist these paths and `/auth` are not served
 (404). A missing, expired or wrongly signed token, or one of another algorithm, gets 401 with
@@ -690,6 +961,39 @@ curl -H 'Content-Type: application/json' -d '{"name": "alice", "password": "s3cr
 curl -H "Authorization: Bearer $TOKEN" http://10.0.0.4:7081/config
 ```
 
+### The /status/full page
+
+`/status/full`, with the same token as `/config`, shows the whole status document, as `/status`
+does with `web.status_content` `full`, whatever that setting says, so the Router Manager shows
+every service and tunnel while the public status page shows less.
+
+### The shell
+
+While `web.shell` is `true`, `/shell` gives a member of `admins` whose console login is on (see
+Console login and SSH) a login shell on the router, as the user's console account, for the
+Router Manager's Shell page. It is off by default and switched on and off on the router only:
+
+```sh
+vpn-router-user console alice --posix
+vpn-config-edit set web.shell true
+```
+
+| Request | Body | Answer |
+| --- | --- | --- |
+| `POST /shell` | `{"password", "code"}`; `code` only for a user enrolled for TOTP | `{"ticket", "expires_in": 30}` |
+| `GET /shell?ticket=<ticket>` | a WebSocket handshake | the terminal |
+
+`POST /shell` needs an access token of `/auth`, not one of `vpn-router-token`, and signs its user
+in again: a wrong password or code gets 403 and counts as a failed login; it gets 403 too while
+`web.shell` is `false` or the user's console login is off. The ticket opens one
+shell for the same user within 30 seconds. Over the WebSocket, binary messages of the client
+are keystrokes, a text message `{"cols", "rows"}` sets the window size, and binary messages of
+the router are the terminal's output. The shell is a PAM login session of the console account,
+run by `systemd-run` in a transient unit `vpn-router-shell-<id>`; sudo works as for SSH. It is closed after `web.shell_idle_minutes` without a keystroke, when the shell
+exits, or when the connection closes; the router then sends a close frame with the reason. The
+journal of `vpn-router-web` records who opened each shell, from which address, in which unit,
+when it ended and why, and each refused ticket or shell with the reason.
+
 ### The /config page
 
 `/config` shows what `/` and `/status` leave out, for a client such as manage-ui:
@@ -702,6 +1006,7 @@ curl -H "Authorization: Bearer $TOKEN" http://10.0.0.4:7081/config
 | `wireguard` | The public key and port of `wg0`, and each peer's public key, endpoint, allowed IPs, handshake age and traffic; no private or preshared key |
 | `docker` | `docker.exposed_ports` and the rules of the `VPN-ROUTER-DOCKER` chain |
 | `postgresql` | `clusters`: each PostgreSQL cluster of `pg_lsclusters` with its version, name, port, status and data directory, and for one that is online its `settings`: `server_version`, `listen_addresses`, `port`, `max_connections`, `shared_buffers`, `effective_cache_size`, `work_mem`, `password_encryption`, `ssl` and `timezone`; `null` when `pg_lsclusters` fails |
+| `caddy` | The installed Caddy: `version`, and `source`, `upstream` once Caddy's repository is configured and `ubuntu` otherwise; `null` when Caddy is not installed |
 
 ### The /postgresql page
 
@@ -716,13 +1021,13 @@ router:
 
 `/users` manages users with the same token as `/config`, with the module `vpn-router-user` uses
 too, `/usr/lib/vpn-router/vpnrouter_users.py`, so both apply the same rules. Request
-and answer bodies are JSON; a request body is at most 4096 bytes.
+and answer bodies are JSON; a request body is at most 65536 bytes.
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /users` | | `{"users": [{"name", "manager_only", "service", "internal", "enabled", "locked", "certificate", "otp", "first_name", "last_name", "email"}, ...]}` |
+| `GET /users` | | `{"users": [{"name", "manager_only", "service", "internal", "enabled", "locked", "certificate", "otp", "console", "wireguard_peers", "first_name", "last_name", "email"}, ...], "wireguard": {"enabled", "address"}}`; `console` is `null` or `{"enabled", "account", "local", "uid"}`, `wireguard_peers` a list of `{"public_key", "ips"}`, and `wireguard` the endpoint's settings, whose network the peers' addresses come from |
 | `POST /users` | `{"name", "password", "first_name", "last_name", "email"}` for a VPN user; `{"name", "password", "email"?}` for a Manager-only account | 201 and the user |
-| `PUT /users/<name>` | any of `{"first_name", "last_name", "email"}`; for a Manager-only account only `{"email"}`, `""` removing it | the user |
+| `PUT /users/<name>` | any of `{"first_name", "last_name", "email", "wireguard_peers"}`; `wireguard_peers`, `[{"public_key", "ips"}]`, replaces a VPN user's WireGuard peers (see Configuration); for a Manager-only account only `{"email"}`, `""` removing it | the user |
 | `PUT /users/<name>/password` | `{"password": ...}` | the user |
 | `POST /users/<name>/disable` | | the user |
 | `POST /users/<name>/enable` | | the user |
@@ -732,6 +1037,7 @@ and answer bodies are JSON; a request body is at most 4096 bytes.
 | `POST /users/<name>/otp` | | `{"name", "secret", "uri"}`, a new TOTP secret; nothing is stored |
 | `PUT /users/<name>/otp` | `{"secret", "code"}` | the user, once the code matches the secret |
 | `DELETE /users/<name>/otp` | | the user |
+| `PUT /users/<name>/console` | `{"enabled", "account"?}`; only with a token of `vpn-router-token` | the user |
 
 A failure is `{"error": ...}` with 400 for an invalid request, 404 for a user that does not
 exist or is a service account, 409 for a user that exists and 500 otherwise. `/users` does not
@@ -752,18 +1058,19 @@ curl -H "Authorization: Bearer $TOKEN" -H 'Content-Type: application/json' \
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /service-accounts` | | `{"service_accounts": [{"name", "internal", "enabled", "locked", "email", ...}, ...]}`, each as `/users` shows a user |
-| `POST /service-accounts` | `{"name", "password", "email"?}` | 201 and the account |
-| `PUT /service-accounts/<name>` | `{"email"}`; `""` removes it | the account |
+| `GET /service-accounts` | | `{"service_accounts": [{"name", "display_name", "description", "internal", "enabled", "locked", "email", ...}, ...]}`, each as `/users` shows a user |
+| `POST /service-accounts` | `{"name", "password", "display_name"?, "description"?, "email"?}` | 201 and the account |
+| `PUT /service-accounts/<name>` | any of `{"display_name", "description", "email"}`; `""` removes one | the account |
 | `PUT /service-accounts/<name>/password` | `{"password": ...}` | the account |
 | `POST /service-accounts/<name>/disable` | | the account |
 | `POST /service-accounts/<name>/enable` | | the account |
 | `POST /service-accounts/<name>/unlock` | | the account |
 | `DELETE /service-accounts/<name>` | | `{"name", "removed": true}` |
 
-The internal service accounts, `internal` true, are only listed: every other request on one gets
-403, as the router manages them. A failure is otherwise as for `/users`, with 404 also for a
-name that is not a service account.
+A display name has at most 64 printable characters and a description at most 256. The internal
+service accounts, `internal` true, are only listed: every other request on one gets 403, as the
+router manages them, their display name and description included. A failure is otherwise as for
+`/users`, with 404 also for a name that is not a service account.
 
 ### The /account API
 
@@ -808,8 +1115,8 @@ group.
 
 | Request | Body | Answer |
 | --- | --- | --- |
-| `GET /site-to-site` | | `{"connections": [{"name", "addrs", "id", "cidrs", "local_cidrs", "local_id_mode", "psk_file", "psk_set", "established"}, ...]}` |
-| `POST /site-to-site` | `{"name", "addrs", "id", "cidrs", "local_cidrs", "local_id_mode", "psk"}`; `psk` is required | 201 and the connection |
+| `GET /site-to-site` | | `{"connections": [{"name", "addrs", "id", "cidrs", "local_cidrs", "local_id_mode", "auth", "psk_file", "remote_ca", "psk_set", "established"}, ...]}` |
+| `POST /site-to-site` | `{"name", "addrs", "id", "cidrs", "local_cidrs", "local_id_mode", "auth", "psk", "remote_ca"}`; `psk` is required with `auth` `psk`, the default | 201 and the connection |
 | `PUT /site-to-site/<name>` | any of the settings of `POST` but `name`; an empty or absent `psk` keeps the key, a `psk` given replaces `psk_file` | the connection |
 | `DELETE /site-to-site/<name>` | | `{"name", "removed": true}` |
 
@@ -821,6 +1128,77 @@ is `{"error": ...}` with 400 for an invalid request or configuration, with the r
 connection that does not exist, 409 for a name that exists and 500 otherwise. Keys cross the
 internal network in plain HTTP, like the token.
 
+### The /backup API
+
+`/backup` shows and changes the backup settings and starts a backup, with the same token as
+`/users`.
+
+| Request | Body | Answer |
+| --- | --- | --- |
+| `GET /backup` | | `{"settings", "state", "archives", "next", "client", "rclone"}` |
+| `PUT /backup` | any of the settings of the `backup` section; an empty or absent `pbs_password` keeps the secret | `{"settings"}` |
+| `POST /backup/run` | | 202 and `{"started": true}`; 409 while a backup runs |
+
+The answer of `GET /backup` holds:
+
+- **`settings`:** the `backup` section without `pbs_password`, with `pbs_password_set`.
+- **`state`:** the last run, `null` before the first. Its `result` is `running`, `ok`, `warning` (the backup was made but the cloud copy failed), `failed` or `interrupted` (the run ended without recording its result). It also has `started`, `finished`, `target`, `archive` or `snapshot`, `size` in bytes, `removed` (the archives retention deleted), `error` and `cloud` (`{"remote", "mode", "result", "error"}`).
+- **`archives`:** the local archives of this host, newest first, as `{"name", "time", "size"}`.
+- **`next`:** the next run as systemd shows it, `null` while backups are off.
+- **`client`:** whether `proxmox-backup-client` is installed.
+- **`rclone`:** `{"installed", "config", "remotes"}`, the remotes being the sections of `rclone.conf`.
+
+A change is made, checked and applied as for `/site-to-site`.
+
+### The /remote-access API
+
+`/remote-access` shows and changes the remote access systems, IKEv2 road-warrior (`p2s`),
+OpenVPN (`openvpn`) and WireGuard (`wireguard`), with the same token as `/users`.
+
+| Request | Body | Answer |
+| --- | --- | --- |
+| `GET /remote-access` | | `{"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}`; `wireguard_server` is `{"public_key", "endpoint", "allowed_ips"}`: the router's WireGuard public key (`null` before setup made it), `<wan.local_fqdn>:<wireguard.listen_port>` (`null` without a name) and the networks a peer reaches through the tunnel, the router's local CIDRs and the WireGuard network |
+| `PUT /remote-access/<system>` | any of the settings of the section `p2s`, `openvpn` or `wireguard` | the section |
+
+`running` tells for each system whether setup runs it. IKEv2 and OpenVPN run once enabled with an
+address pool, `wan.local_fqdn` set and the router's VPN server certificate issued by the P2S CA;
+WireGuard once enabled with an address. A system enabled without its address pool or address is
+refused. A change is made, checked and applied as for `/site-to-site`. The router's firewall
+follows the settings; a cloud firewall in front of the router, such as an Azure network security
+group, must allow the OpenVPN and WireGuard ports itself.
+
+### The /ca API
+
+`/ca` manages the PKI (see Certificates) with the same token as `/users`, with the module
+`vpn-router-ca` uses too, `/usr/lib/vpn-router/vpnrouter_pki.py`.
+
+| Request | Body | Answer |
+| --- | --- | --- |
+| `GET /ca` | | `{"settings", "templates", "extended_key_usages", "status", "certificates"}` |
+| `PUT /ca` | any of the settings of the `pki` section | `{"settings", "templates"}` |
+| `POST /ca/certificates` | `{"ca", "template", "csr"}` | 201 and `{"serial", "certificate", "chain"}`, PEM |
+| `POST /ca/certificates` | `{"ca", "template", "subject", "sans", "password"}` | 201 and `{"serial", "pfx"}`, a PKCS#12 file in base64 |
+| `POST /ca/certificates/<serial>/revoke` | `{"reason"}`, optional | the certificate, with `reissue` for a router certificate |
+| `GET /ca/bundle/<name>` | | `{"name", "pem"}`: the certificates a client trusts the CA with, the root alone for `root`, the issuing CA followed by the root for an issuing CA |
+| `GET /ca/issuing/<name>/csr` | | `{"name", "csr", "extensions"}` of an issuing CA waiting for the offline root |
+| `PUT /ca/issuing/<name>/certificate` | `{"certificate"}`, PEM, signed by the root | `{"name", "subject", "expires"}` |
+| `PUT /ca/root/crl` | `{"crl"}`, PEM, signed by the root | `{"next_update"}` |
+
+The answer of `GET /ca` holds:
+
+- **`settings`:** the `pki` section.
+- **`templates`:** every template, the built-in ones included, with all its options.
+- **`extended_key_usages`:** every extended key usage templates may give, name -> `{"oid", "builtin"}`.
+- **`status`:** `root` (`subject`, `expires`, `key`, whether the root key is on the router, `crl_next_update` and `crl_source`, `signed` or `uploaded`), `authorities`, one per issuing CA (`name`, `common_name`, `state`: `active`, `pending` or `missing`, `builtin`, `templates`, `acme`, `subject`, `expires`, `key`, `crl_next_update`, `acme_url`), `retired` and `warnings`.
+- **`certificates`:** the certificates issued, newest first, each `{"serial", "ca", "kind", "template", "subject", "sans", "created", "expires", "revoked", "reason", "state"}`; `kind` is `ca`, `router`, `user` or `external`, and `state` `valid`, `expired` or `revoked`.
+
+A change of the settings is made, checked and applied as for `/site-to-site`; an imported issuing
+CA certificate and a revoked router certificate restart `vpn-router-setup` too. A failure is
+`{"error": ...}` with 400 for an invalid request, 404 for something that does not exist, 409 when
+the state does not allow it, as for a revoked certificate or an issuing CA that has its
+certificate, and 500 otherwise. The root key never crosses the API; `vpn-router-ca` exports,
+removes and imports it.
+
 The service starts on its own, without waiting for `vpn-router-setup`, and keeps running. Every
 30 seconds it reads `web.listen`, `web.port` and `web.enabled` from `vpn-router.json` and works
 out the addresses of the interfaces `web.listen` names as `general.mode` directs; it listens on
@@ -833,7 +1211,7 @@ and the facts for `/config` from `/run/vpn-router/web.json` (readable by root on
 
 ## HTTPS
 
-Caddy, from Ubuntu's `caddy` package, serves the status web service on `https.web_port` (7444 by
+Caddy serves the status web service on `https.web_port` (7444 by
 default), while the Router Manager is installed the manager on `https.manager_port` (7443), and
 while metrics are enabled the metrics service on `metrics.https_port` (9465), all for `wan.local_fqdn`, while `https.enabled` is `true` and `wan.local_fqdn` is set. It obtains
 and renews the certificate from Let's Encrypt with the HTTP challenge, so `wan.local_fqdn` must
@@ -847,7 +1225,8 @@ package's drop-in `/usr/lib/systemd/system/caddy.service.d/vpn-router.conf` make
 read; `caddy.service` does not start before the file exists, and `/etc/caddy/Caddyfile` is not
 used. Setup starts Caddy, reloads it when the file changes, and stops it and removes the file when
 HTTPS is off. In the firewall it opens port 80 on the external interface and the HTTPS ports on the
-internal and the external interface. Caddy calls both services on `127.0.0.1`, where they listen
+internal and the external interface, and ports 80 and 443 on both when `pki.publish` has `http-80`
+and `https-default`, on which Caddy serves only the CA files (see Certificates). Caddy calls both services on `127.0.0.1`, where they listen
 whatever `web.listen` and the manager's `listen` say, and passes the client's address in
 `X-Forwarded-For`, which the manager trusts from `127.0.0.1` and the web service by default, as
 the address the call came in on; a `web.trusted_proxies` that is set must list `127.0.0.1`. The plain HTTP ports stay as
@@ -858,6 +1237,34 @@ the HTTPS ports while `https.enabled` is `true`.
 curl https://router.example.com:7444/status
 ```
 
+### Installing Caddy
+
+The package does not depend on Caddy; `vpn-router-setup` has it installed, while HTTPS is on,
+from the source `https.caddy_source` names:
+
+- `ubuntu`, the default: the `caddy` package of the Ubuntu archive.
+- `upstream`: Caddy's own repository, `https://dl.cloudsmith.io/public/caddy/stable/deb/debian`,
+  whose source the package writes to `/etc/apt/sources.list.d/caddy-stable.sources` with its key,
+  downloaded over HTTPS, in `/etc/apt/keyrings/caddy-stable.asc`.
+
+apt runs in `vpn-router-caddy.service`, which waits for dpkg's lock, so setup run by a package
+installation does not wait for itself; the unit runs `vpn-router-caddy apply` and then setup
+again, which serves with the new Caddy. `vpn-router-caddy status` shows the configured source, the
+source in effect and the versions.
+
+A router installed with `ubuntu` is switched to upstream's Caddy with:
+
+```sh
+vpn-router-caddy use-upstream
+```
+
+It sets `https.caddy_source` to `upstream`, configures the repository and replaces Caddy, printing
+each step. Upstream versions sort above Ubuntu's, so once the repository is configured apt keeps
+upstream's Caddy, and `ubuntu` has no effect; setup says so. Going back is a downgrade nothing
+does on its own: remove the source and the key, run `apt-get update`, and install Ubuntu's version
+with `apt-get install --allow-downgrades caddy=<version>`, the version `apt-cache policy caddy`
+lists for the archive.
+
 ## Metrics
 
 While `metrics.enabled` is `true`, `vpn-router-setup` runs `vpn-router-metrics`, which every minute
@@ -907,6 +1314,17 @@ How it works:
   | `month` | 6 hours | hourly |
   | `year` | 1 month | monthly |
 
+- **Site-to-site availability:** `site_to_site_up` of the same answer divides the view into slots of its own, `slot`, and gives for each slot and connection the percentage of the samples in which the connection was up, 0 to 100, as `points` of `{"time", "connections": {name: percent}}`:
+
+  | Range | Slot | Source |
+  |---|---|---|
+  | `hour` | 5 minutes | details |
+  | `day` | 1 hour | details |
+  | `month` | 1 day | hourly |
+  | `year` | 1 month | monthly |
+
+  A sample is taken every minute, so an interruption shorter than a minute may be missed; a slot without samples has no value, and the year view, like the others of its level, has the complete months only.
+
 ### Scraping
 
 `GET /metrics` of the metrics service serves the last sample in the Prometheus text format, written by `prometheus_client`.
@@ -952,11 +1370,107 @@ When `metrics.otlp_endpoint` is set, every sample is also pushed there as an OTL
 - **Authentication:** HTTP Basic with `metrics.otlp_username` and `metrics.otlp_password` when they are set.
 - **Failures:** a failed push is logged and not repeated; the next sample is pushed a minute later.
 
+## Backups
+
+While `backup.enabled` is `true`, `vpn-router-setup` runs `vpn-router-backup.timer` on `backup.schedule`. The timer starts `vpn-router-backup.service`, which runs `vpn-router-backup run`. The schedule is written to `/etc/systemd/system/vpn-router-backup.timer.d/schedule.conf`:
+
+- `hourly` runs at the start of each hour;
+- `daily` runs at midnight;
+- `weekly` runs at midnight between Sunday and Monday.
+
+A run missed while the router was off is made at the next boot.
+
+### What a backup holds
+
+A backup holds the state that `vpn-router-setup` cannot make again:
+
+| Item | Content |
+|---|---|
+| `/etc/vpn-router` | `vpn-router.json`, the secrets and `rclone.conf` |
+| `/etc/wireguard` | The WireGuard keys and the peers |
+| `/etc/ufw`, `/etc/default/ufw` | The firewall rules |
+| `/etc/vpn-router-manager` | The Router Manager's settings, when it is installed |
+| `files/<path>` | Each `psk_file` outside `/etc/vpn-router` |
+| `ldap/vpn-router.ldif` | The user directory, written by `slapcat`: users, groups, service accounts, password hashes and TOTP secrets, and the PKI: the CAs and their keys, the root key while it is on the router, and the certificates issued, with the keys of the router's and the users' certificates |
+| `postgresql/vpn-router.dump` | With `backup.metrics`, the database of the metrics and the refresh tokens, written by `pg_dump -Fc` |
+| `manifest.json` | The host, the time, the version of the package, the schedule and the items |
+
+The files and the directory are copied while the locks of the configuration and of the users are held, so no change of the API or the command-line tools falls between them; `pg_dump` reads a snapshot of its own. The copy is staged in `/var/lib/vpn-router/backup/staging`, which is removed after each run. The backup holds every secret of the router, so keep it as safe as the router itself.
+
+### Local archives
+
+With `backup.target` `local`, a backup is a tar archive compressed with zstd, `vpn-router-<host>-<UTC time>.tar.zst`, in `backup.path` (mode 0600, the folder 0700). The folder may be a mount, such as an NFS share or an Azure Files share, which exports the archives.
+
+After each backup, the archives of this host that the retention settings no longer keep are deleted. The rules are those of Proxmox Backup Server's prune:
+
+- The settings apply in order: `keep_hourly`, `keep_daily`, `keep_weekly` (ISO weeks, Monday to Sunday), `keep_monthly`, `keep_yearly`.
+- Each keeps the newest archive of each of its last N periods that have archives, in local time.
+- A period that has an archive a former setting kept is passed over.
+- A setting finer than the schedule does not apply: `keep_hourly` only with `hourly`, `keep_daily` with `hourly` and `daily`. At least one setting that applies must be above 0.
+
+### Cloud copy with rclone
+
+With `backup.rclone_remote` set, each local backup is followed by an rclone run that copies the archives of this host to the remote. rclone comes from the `rclone` package, which the package suggests:
+
+```sh
+sudo apt-get install rclone
+sudo rclone config --config /etc/vpn-router/rclone.conf
+sudo chmod 0600 /etc/vpn-router/rclone.conf
+sudo vpn-config-edit set backup.rclone_remote azure:backups/router
+sudo systemctl restart vpn-router-setup
+```
+
+The two modes:
+
+- `sync` (the default) makes the remote mirror the archives of this host, so an archive retention deletes is deleted remotely too.
+- `copy` uploads new archives and deletes nothing, so retention in the cloud is left to its own rules, such as a lifecycle policy.
+
+Other files in the remote path are left alone in both modes. A failed cloud copy leaves the local backup in place, and the run's result is `warning`.
+
+### Proxmox Backup Server
+
+With `backup.target` `pbs`, the staged copy is sent with `proxmox-backup-client` as the archive `router.pxar` of the snapshot `host/<host>/<time>`, in `backup.pbs_namespace` when it is set. The server keeps the snapshots by its own prune jobs; the router prunes nothing.
+
+The static client comes from Proxmox's client repository, which the package suggests but does not set up. Following Proxmox's installation guide, as `/etc/apt/sources.list.d/pbs-client.sources`:
+
+```text
+Types: deb
+URIs: http://download.proxmox.com/debian/pbs-client
+Suites: trixie
+Components: main
+Signed-By: /usr/share/keyrings/proxmox-archive-keyring.gpg
+```
+
+Get the key `https://enterprise.proxmox.com/debian/proxmox-archive-keyring-trixie.gpg` into `/usr/share/keyrings/proxmox-archive-keyring.gpg`, check it against the SHA-256 the [installation guide](https://pbs.proxmox.com/docs/installation.html) gives, and install `proxmox-backup-client-static`. Until it is installed, a backup to PBS fails with a message that names the package; nothing else depends on it.
+
+On the server, make an API token for the router and give the token itself the `DatastoreBackup` role on `/datastore/<store>`, or on the namespace path. `backup.pbs_repository` names the token, such as `backup@pbs!router@pbs.example.com:store`, and `backup.pbs_password` holds its secret. Set `backup.pbs_fingerprint` when the server's certificate is self-signed. With `backup.pbs_keyfile`, the snapshot is encrypted with a key of `proxmox-backup-client key create --kdf none <file>`. Keep a copy of that key away from the router, since a restore needs it.
+
+### Running, listing and restoring
+
+```sh
+sudo vpn-router-backup run          # a backup now, whether or not backups are enabled
+sudo vpn-router-backup list         # the local archives, or the snapshots on the server
+sudo vpn-router-backup restore /var/backups/vpn-router/vpn-router-router-20261025T030000Z.tar.zst
+sudo vpn-router-backup restore --pbs host/router/2026-10-25T03:00:00Z
+```
+
+Each run is recorded in `/var/lib/vpn-router/backup.json`, which `/backup` and the Router Manager show. Only one run or restore takes place at a time.
+
+`restore` is only on the command line. It shows what the backup holds and asks for `yes`, which `--yes` gives. It then:
+
+1. stops the web service, the metrics service and slapd;
+2. puts back the files;
+3. loads the directory with `slapadd` into an empty `/var/lib/ldap/vpn-router`;
+4. sets the database role's password to the restored `database.secret`, and restores the database with `pg_restore --clean` when the backup holds it;
+5. restarts `vpn-router-setup`, which regenerates everything else, followed by WireGuard, OpenVPN, strongSwan and the Router Manager, and reloads ufw.
+
+What it replaces is kept in `/var/lib/vpn-router/backup/before-restore/<UTC time>`. To restore onto a new VM, install the package first and let `vpn-router-setup` run once. The restored configuration names the interfaces of the old VM, so change them with `vpn-config-edit` if they differ.
+
 ## Router Manager
 
 The `vpn-router-manager` package, built in the repository `linux-cloud-router-manager`, is a web
-application that shows the state of the router and manages its users and site-to-site
-connections through the status web service. It can be installed on the router or on another Linux system. While it is installed on
+application that shows the state of the router and manages its users, site-to-site
+connections, backups and certificates through the status web service. It can be installed on the router or on another Linux system. While it is installed on
 the router, `vpn-router-setup` opens its port (`port` in `/etc/vpn-router-manager/manager.json`,
 7080 by default, HTTP; HTTPS is Caddy's, on `https.manager_port`) on the internal and the external
 interface; restart `vpn-router-setup` after changing it. The manager's `listen` chooses the
@@ -965,8 +1479,8 @@ interfaces it listens on.
 ## Removal
 
 `apt-get remove` stops `vpn-router-docker`, which removes the Docker rules. It terminates the
-tunnels and takes `wg-quick@wg0`, `openvpn-server@vpn-router`, `caddy` and `vpn-router-metrics`
-down, but leaves the
+tunnels and takes `wg-quick@wg0`, `openvpn-server@vpn-router`, `caddy`, `vpn-router-metrics`,
+`vpn-router-backup.timer` and `vpn-router-pki.timer` down, but leaves the
 configuration in place. `strongswan` is left enabled, since it is a shared service that
 may be in use by something else.
 
@@ -976,8 +1490,13 @@ before deleting it so a later reinstall starts clean. It also removes the web se
 signing key, the password file of the metrics service account, and the database of the refresh
 tokens and the metrics, its role and their password
 file when the package created them, and Caddy's configuration `/etc/caddy/vpn-router.Caddyfile`; the certificate in
-`/var/lib/caddy` belongs to the `caddy` package. Key material and users are never deleted: `/etc/vpn-router/pki`, `/etc/vpn-router/ldap`, the user directory in slapd, the
-WireGuard key pair and everything under `/etc/swanctl` are left alone.
+`/var/lib/caddy` belongs to the `caddy` package. It removes the backup timer's schedule, the
+record of the last backup, the published CA files, the copies of the ACME CAs in
+`/etc/caddy/vpn-router-pki` and OpenVPN's CA and CRL files. Caddy stays installed, and with it the
+source of Caddy's repository. Key material, users and backups are never deleted:
+`/etc/vpn-router/ldap`, `/etc/vpn-router/rclone.conf`, the user directory in slapd with the PKI, the WireGuard
+key pair, everything under `/etc/swanctl`, the archives in `backup.path` and
+`/var/lib/vpn-router/backup/before-restore` are left alone.
 
 ## Building
 

debian-package/debian/changelog

@@ -1,3 +1,305 @@
+vpn-router (0.25.2-1) unstable; urgency=medium
+
+  fix: wireguard.address must be the router's own address in its network, not the network or broadcast address, from which the peers' addresses are told apart.
+
+  * A wireguard.address that is the network or the broadcast address of a
+    network larger than /31, such as 192.168.232.0/24, is refused with the
+    first address of the network as the example.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 02:30:00 +0100
+
+vpn-router (0.25.1-1) unstable; urgency=medium
+
+  fix: /remote-access gives the router's WireGuard public key, endpoint and allowed IPs, which a peer's configuration needs.
+
+  * GET /remote-access answers wireguard_server: {"public_key",
+    "endpoint", "allowed_ips"}.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 01:30:00 +0100
+
+vpn-router (0.25.0-1) unstable; urgency=medium
+
+  feature: a VPN user has WireGuard peers, each a device with its public key and IPs, kept in the directory and written into wg0.conf by setup.
+
+  * PUT /users/<name> takes wireguard_peers, [{"public_key", "ips"}],
+    which replaces the user's peers; keys are unique and IPs may not
+    overlap another peer's or cover the router's WireGuard address.
+  * GET /users answers each user's wireguard_peers and the WireGuard
+    endpoint's enabled and address.
+  * Setup writes a [Peer] section into wg0.conf for each peer of a user
+    who is not disabled, in a marked block, and keeps the peers added by
+    hand; changing a user's peers, disabling, enabling or removing a user
+    with peers applies at once.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 03 Nov 2026 00:00:00 +0100
+
+vpn-router (0.24.1-1) unstable; urgency=medium
+
+  fix: the status gives the number of connected OpenVPN clients at most 5 seconds old instead of up to a minute.
+
+  * The OpenVPN server writes its status file every 5 seconds, so a
+    refresh of the status shows clients that connected or left since.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 23:30:00 +0100
+
+vpn-router (0.24.0-1) unstable; urgency=medium
+
+  feature: /remote-access of the web service shows and changes the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each runs, for the Router Manager's Remote access page.
+
+  * GET /remote-access answers the p2s, openvpn and wireguard sections,
+    which of them setup runs, and wan.local_fqdn; PUT
+    /remote-access/<system> changes one section and restarts setup.
+  * p2s.enabled and openvpn.enabled need their address_pool, and
+    wireguard.enabled its address.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 23:00:00 +0100
+
+vpn-router (0.23.2-1) unstable; urgency=medium
+
+  fix: the shell of a user's own POSIX account opens on the first setup that sets up console login, and the journal records each refused shell with the reason.
+
+  * Setup restarts vpn-router-web when it adds ldap to the name service
+    switch, so the web service finds the POSIX accounts of the directory.
+  * The journal of vpn-router-web records each refused ticket and shell,
+    with the user, the address and the reason.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 22:00:00 +0100
+
+vpn-router (0.23.1-1) unstable; urgency=medium
+
+  fix: the shell runs as the console account of each member of admins, a local account or the user's own POSIX account in the directory, which also signs in with SSH and sudo, instead of one web.shell_user.
+
+  * vpn-router-user console <name> --posix | --account LOCAL | --off, and
+    PUT /users/<name>/console with a token of vpn-router-token, switch a
+    member of admins' console login; leaving admins switches it off.
+  * The user's own POSIX account is served by nslcd from the directory,
+    with a uid from 20000, the group vpn-router-console, which may use
+    sudo, and a home created at the first login; its password is the
+    directory password, followed by the code once enrolled for TOTP.
+  * ssh.ldap_login (false) lets sshd accept that password.
+  * POST /shell and the shell need the user's console login; web.shell_user
+    is gone.
+  * Depends on nslcd, libnss-ldapd, libpam-ldapd and sudo.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 21:00:00 +0100
+
+vpn-router (0.23.0-1) unstable; urgency=medium
+
+  feature: web.shell lets /shell of the web service open a login shell of web.shell_user over a WebSocket for the Router Manager's Shell page, after the user signs in again.
+
+  * web.shell (false), web.shell_user and web.shell_idle_minutes (15).
+  * POST /shell takes the password and the TOTP code and answers a
+    one-time ticket; GET /shell with it is a WebSocket carrying the
+    terminal, closed after web.shell_idle_minutes without a keystroke.
+  * The journal of vpn-router-web records each shell opened and ended.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 20:00:00 +0100
+
+vpn-router (0.22.1-1) unstable; urgency=medium
+
+  fix: the status gives the number of site-to-site connections set up and established, not each connection by name.
+
+  * site_to_site of the status document is {"connections", "established"},
+    and the status page shows "Site to site: N of M established".
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 18:00:00 +0100
+
+vpn-router (0.22.0-1) unstable; urgency=medium
+
+  feature: pki.extended_key_usages adds custom extended key usages by their OIDs, which templates give by name, and a template's policies put certificate policy OIDs into its certificates.
+
+  * pki.extended_key_usages maps a name to the OID of a custom extended
+    key usage; a template's extended_key_usage takes the built-in and the
+    custom names.
+  * The template option policies lists certificate policy OIDs, written
+    into a Certificate Policies extension.
+  * GET /ca answers extended_key_usages, each usage with its OID and
+    whether it is built in.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 14:00:00 +0100
+
+vpn-router (0.21.5-1) unstable; urgency=medium
+
+  fix: /status/full of the status web service gives an authenticated client the whole status, whatever web.status_content says.
+
+  * /status/full takes the token of /config and answers the status
+    document as web.status_content full shows it.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 12:00:00 +0100
+
+vpn-router (0.21.4-1) unstable; urgency=medium
+
+  fix: vpn-router-setup, vpn-router-ca and /ca read a CA's key and CRL from the directory each as itself, instead of failing on a CA with a CRL.
+
+  * A CA's CRL was read as its key and its key as its CRL, so every
+    operation on a CA with a CRL failed with "Could not deserialize key
+    data".
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 02 Nov 2026 10:00:00 +0100
+
+vpn-router (0.21.3-1) unstable; urgency=medium
+
+  fix: the PKI is kept in ou=pki of the router's directory instead of files under /etc/vpn-router/pki, and the router's site-to-site certificate names only the identities its connections present, and /ca/bundle gives the certificate bundle of a CA.
+
+  * The CAs with their certificates, keys, CSRs and CRLs, and every
+    certificate issued with its revocation, are entries of the
+    package's schema in ou=pki; a user's certificate is also the
+    userCertificate of the user's entry, and only root reads a key.
+  * slapcat puts the PKI into every backup with the users.
+  * A root CA supplied as /etc/vpn-router/pki/root/cert.pem and key.pem
+    before the first setup is imported into the directory, and the files
+    are removed; vpn-router-ca root import-cert is gone.
+  * Setup provisions the directory before the configuration; without it,
+    the PKI and its files are left as they are.
+  * The router's site-to-site certificate names wan.local_fqdn and the
+    public or internal address a connection with auth certificate uses
+    as its identity, not every address of the router, and is issued
+    again when those names change.
+  * GET /ca/bundle/<name> of the status web service answers the PEM
+    certificates a client trusts a CA with: the root alone, or an issuing
+    CA followed by the root.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sun, 01 Nov 2026 10:00:00 +0100
+
+vpn-router (0.21.2-1) unstable; urgency=medium
+
+  fix: pki.root_key_warning silences the warning of vpn-router-ca status and /ca about the root key on the router.
+
+  * pki.root_key_warning, true by default, set to false silences the
+    warning that the root key is on the router.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Sat, 31 Oct 2026 10:00:00 +0100
+
+vpn-router (0.21.1-1) unstable; urgency=medium
+
+  fix: vpn-router-ca status and /ca warn about a CRL the router signs only once vpn-router-pki.timer has not renewed it in time.
+
+  * A CRL whose CA key is on the router is reported once past half of its
+    validity, when the timer should have signed it again; a root CRL
+    signed offline is still reported 30 days before it expires.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Fri, 30 Oct 2026 10:00:00 +0100
+
+vpn-router (0.21.0-1) unstable; urgency=medium
+
+  feature: the router has a two-level CA with an optional offline root, issuing CAs for P2S, site-to-site and general use, templates, published certificates and CRLs and an ACME server, site-to-site connections authenticate with certificates, and setup installs Caddy from Ubuntu or Caddy's repository.
+
+  * The root CA signs the issuing CAs p2s, which issues the router's VPN
+    server certificate and the users' certificates, s2s, which issues
+    the site-to-site certificates, and the general-purpose CAs of
+    pki.issuing_cas; road-warrior and OpenVPN accept certificates of p2s
+    only.
+  * The pki section of vpn-router.json sets the names, lifetimes and
+    key type of the CAs, the validity of the CRLs, where certificates
+    and CRLs are published, the general-purpose CAs and the certificate
+    templates; p2s.ca_name and the vpn-router/p2s_ca_name question are
+    replaced by pki.root_name and vpn-router/pki_root_name.
+  * Without the root key on the router, new issuing CAs wait with a CSR
+    for an offline signature; vpn-router-ca exports, removes and imports
+    the root key, imports the signed certificates and a root CRL, issues
+    certificates from a CSR or into a PFX file, lists and revokes them.
+  * Certificates name their issuer's certificate and CRL at the
+    endpoints of pki.publish: the status port over HTTP, or Caddy on port
+    80, on the HTTPS status port or on port 443; the CRLs are signed
+    again at every revocation and by vpn-router-pki.timer.
+  * A general-purpose CA with acme backs an ACME server of Caddy.
+  * The router renews its own certificates before they expire.
+  * A site-to-site connection with auth certificate authenticates with
+    the router's site-to-site certificate and trusts the s2s CA or the
+    connection's remote_ca.
+  * /ca of the status web service shows and changes the PKI; /pki/
+    serves the published certificates and CRLs; /config shows the
+    installed Caddy and its source; request bodies may be 64 KiB.
+  * vpn-router no longer depends on caddy: vpn-router-setup installs it
+    from https.caddy_source, the Ubuntu archive or Caddy's repository,
+    and vpn-router-caddy use-upstream switches an installed router to
+    Caddy's repository for good.
+  * The package depends on python3-cryptography instead of openssl, and
+    simple-ca is gone.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Thu, 29 Oct 2026 10:00:00 +0100
+
+vpn-router (0.20.0-1) unstable; urgency=medium
+
+  feature: the router makes scheduled backups to a local folder, copied to the cloud with rclone, or to a Proxmox Backup Server, and vpn-router-backup restores them.
+
+  * The backup section of vpn-router.json switches on backups and sets
+    the schedule (hourly, daily or weekly), the target (local or pbs),
+    the folder, the retention of local archives, whether the metrics
+    database is included, the rclone remote and mode, and the Proxmox
+    Backup Server repository, token secret, fingerprint, namespace and
+    key file.
+  * A backup holds /etc/vpn-router, /etc/wireguard, the ufw rules, the
+    Router Manager's settings, PSK files outside /etc/vpn-router, the
+    user directory as slapcat writes it and, optionally, the database as
+    pg_dump writes it, copied while the configuration and the users are
+    locked.
+  * Local backups are tar archives compressed with zstd. Archives the
+    retention settings no longer keep are deleted by the rules of Proxmox
+    Backup Server's prune, and rclone can sync or copy the archives to a
+    remote of /etc/vpn-router/rclone.conf.
+  * Backups to a Proxmox Backup Server are made with
+    proxmox-backup-client-static, which the package suggests; the server
+    keeps them.
+  * vpn-router-backup runs a backup, lists the backups and restores a
+    local archive or a snapshot; vpn-router-backup.timer runs it on the
+    schedule.
+  * /backup of the status web service shows and changes the backup
+    settings, shows the last run, the local archives and the next run,
+    and starts a backup.
+  * The package depends on zstd and suggests rclone and
+    proxmox-backup-client-static.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Wed, 28 Oct 2026 10:00:00 +0100
+
+vpn-router (0.19.1-3) unstable; urgency=medium
+
+  update: ADR-24 names Ubuntu's apt-daily timer, not a cron job, as what updates the package lists.
+
+  * ADR-24 says that Ubuntu's apt-daily timer updates the package lists
+    twice a day, and that apt-daily or unattended-upgrades may hold the
+    dpkg lock the upgrade waits for.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 27 Oct 2026 10:00:00 +0100
+
+vpn-router (0.19.1-2) unstable; urgency=medium
+
+  update: ADR-24 says that the Router Manager checks for updates on demand.
+
+  * ADR-24 describes Check update of the Router Manager, which updates
+    apt's package lists in the transient unit vpn-router-manager-check.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Tue, 27 Oct 2026 09:00:00 +0100
+
+vpn-router (0.19.1-1) unstable; urgency=medium
+
+  fix: /metrics/history gives the availability of each site-to-site connection as the percentage of time it was up in slots of the view.
+
+  * site_to_site_up of /metrics/history divides the view into slots of 5
+    minutes for an hour, 1 hour for a day, 1 day for a month and 1 month
+    for a year, and gives for each slot and connection the percentage of
+    the samples in which the connection was up.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 26 Oct 2026 21:00:00 +0100
+
+vpn-router (0.19.0-1) unstable; urgency=medium
+
+  feature: service accounts have a display name and a description, which the router sets for its internal ones.
+
+  * vpnRouterAccount of the package's schema also takes displayName and
+    description; vpn-router-setup updates the schema of an existing
+    directory.
+  * /service-accounts shows display_name and description, takes them when
+    adding a service account and changes them with PUT; "" removes one.
+    /users shows them as null.
+  * vpn-router-user add --service and update take --display-name and
+    --description.
+  * vpn-router-setup gives the metrics service's internal account the
+    display name Metrics and its description, and sets them again when
+    they differ.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Mon, 26 Oct 2026 20:00:00 +0100
+
 vpn-router (0.18.3-1) unstable; urgency=medium
 
   fix: internal service accounts are the router's own, of which the metrics service's is the one at present, and the documentation says what a service account is.

debian-package/debian/config

@@ -51,6 +51,7 @@ db_input high vpn-router/remote_addrs || true
 db_input high vpn-router/remote_id || true
 db_input high vpn-router/remote_cidrs || true
 db_input high vpn-router/psk || true
+db_input high vpn-router/pki_root_name || true
 db_input high vpn-router/p2s_enabled || true
 db_input high vpn-router/wg_enabled || true
 db_go || true
@@ -58,7 +59,6 @@ db_go || true
 db_get vpn-router/p2s_enabled
 if [ "$RET" = "true" ]; then
     db_input high vpn-router/p2s_address_pool || true
-    db_input high vpn-router/p2s_ca_name || true
     db_go || true
 fi
 

debian-package/debian/control

@@ -17,8 +17,8 @@ Depends: ${misc:Depends},
          ufw,
          debconf,
          ucf,
-         openssl,
          python3,
+         python3-cryptography,
          python3-jinja2,
          python3-ldap,
          python3-pyotp,
@@ -27,19 +27,32 @@ Depends: ${misc:Depends},
          python3-prometheus-client,
          postgresql,
          slapd,
+         nslcd,
+         libnss-ldapd,
+         libpam-ldapd,
+         sudo,
          openvpn,
          openvpn-auth-ldap,
          iproute2,
          systemd-resolved,
-         caddy
+         zstd
+Suggests: caddy,
+          rclone,
+          proxmox-backup-client-static
 Description: Linux VPN router with IPSec, road-warrior, OpenVPN and WireGuard support
  Configures a Linux host or virtual machine as a VPN router: site-to-site
- IKEv2 IPSec (strongSwan swanctl), optional road-warrior access using EAP-TLS,
- optional OpenVPN with a certificate and a password per user, kept in a local
- LDAP directory, optional WireGuard, and the routing, NAT, MSS clamping and
- firewall rules a router needs. It keeps metrics of the router in PostgreSQL
- and serves them for an OpenTelemetry Collector. Nothing in the package is
- specific to a cloud provider.
+ IKEv2 IPSec (strongSwan swanctl) with pre-shared keys or certificates,
+ optional road-warrior access using EAP-TLS, optional OpenVPN with a
+ certificate and a password per user, kept in a local LDAP directory, optional
+ WireGuard, and the routing, NAT, MSS clamping and firewall rules a router
+ needs. Its two-level CA, whose root may be kept offline, has issuing CAs for
+ the VPN clients, for site-to-site and for general use, and publishes their
+ certificates and CRLs. Caddy, installed by the package from the Ubuntu
+ archive or from Caddy's repository, serves HTTPS. It keeps metrics of the
+ router in PostgreSQL and serves them for an OpenTelemetry Collector, and
+ makes scheduled backups to a local folder, copied to the cloud with rclone,
+ or to a Proxmox Backup Server. Nothing in the package is specific to a cloud
+ provider.
  .
  Settings live in /etc/vpn-router/vpn-router.json, which is created on first
  install and owned by the administrator afterwards. Editing it and restarting

debian-package/debian/install

@@ -7,12 +7,17 @@ src/usr/lib/vpn-router/vpnrouter_users.py             usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_auth.py              usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_metrics.py           usr/lib/vpn-router/
 src/usr/lib/vpn-router/vpnrouter_status.py            usr/lib/vpn-router/
+src/usr/lib/vpn-router/vpnrouter_backup.py            usr/lib/vpn-router/
+src/usr/lib/vpn-router/vpnrouter_pki.py               usr/lib/vpn-router/
 src/usr/lib/vpn-router/openvpn-same-user              usr/lib/vpn-router/
+src/usr/lib/vpn-router/openvpn-issuer                 usr/lib/vpn-router/
 src/usr/sbin/vpn-router-user                          usr/sbin/
 src/usr/sbin/vpn-router-group                         usr/sbin/
 src/usr/sbin/vpn-router-token                         usr/sbin/
 src/usr/sbin/vpn-config-edit                          usr/sbin/
-src/usr/lib/vpn-router/simple-ca                      usr/lib/vpn-router/
+src/usr/sbin/vpn-router-backup                        usr/sbin/
+src/usr/sbin/vpn-router-ca                            usr/sbin/
+src/usr/sbin/vpn-router-caddy                         usr/sbin/
 src/usr/lib/vpn-router/configure                      usr/lib/vpn-router/
 src/usr/lib/vpn-router/docker-rules                   usr/lib/vpn-router/
 src/usr/lib/vpn-router/setup                          usr/lib/vpn-router/

debian-package/debian/postinst

@@ -31,7 +31,7 @@ case "$1" in
         answer vpn-router/psk;              VPN_ROUTER_PSK="$ANSWER"
         answer vpn-router/p2s_enabled;      VPN_ROUTER_P2S_ENABLED="$ANSWER"
         answer vpn-router/p2s_address_pool; VPN_ROUTER_P2S_ADDRESS_POOL="$ANSWER"
-        answer vpn-router/p2s_ca_name;      VPN_ROUTER_P2S_CA_NAME="$ANSWER"
+        answer vpn-router/pki_root_name;    VPN_ROUTER_PKI_ROOT_NAME="$ANSWER"
         answer vpn-router/wg_enabled;       VPN_ROUTER_WG_ENABLED="$ANSWER"
         answer vpn-router/wg_address;       VPN_ROUTER_WG_ADDRESS="$ANSWER"
         answer vpn-router/wg_listen_port;   VPN_ROUTER_WG_LISTEN_PORT="$ANSWER"
@@ -44,7 +44,7 @@ case "$1" in
                VPN_ROUTER_REMOTE_ADDRS VPN_ROUTER_REMOTE_ID \
                VPN_ROUTER_REMOTE_CIDRS VPN_ROUTER_PSK \
                VPN_ROUTER_P2S_ENABLED VPN_ROUTER_P2S_ADDRESS_POOL \
-               VPN_ROUTER_P2S_CA_NAME VPN_ROUTER_WG_ENABLED \
+               VPN_ROUTER_PKI_ROOT_NAME VPN_ROUTER_WG_ENABLED \
                VPN_ROUTER_WG_ADDRESS VPN_ROUTER_WG_LISTEN_PORT
 
         # --- Hand a candidate configuration to ucf ---

debian-package/debian/postrm

@@ -53,8 +53,18 @@ case "$1" in
               /etc/vpn-router/vpn-router.json \
               /etc/vpn-router/web.key \
               /etc/vpn-router/metrics.secret \
-              /var/lib/vpn-router/setup.done
-        rmdir --ignore-fail-on-non-empty /var/lib/vpn-router 2>/dev/null || true
+              /etc/systemd/system/vpn-router-backup.timer.d/schedule.conf \
+              /etc/sudoers.d/vpn-router \
+              /etc/ssh/sshd_config.d/vpn-router.conf \
+              /var/lib/vpn-router/setup.done \
+              /var/lib/vpn-router/backup.json
+        rmdir --ignore-fail-on-non-empty /etc/systemd/system/vpn-router-backup.timer.d 2>/dev/null || true
+        # The name service no longer looks up the console accounts of the router's directory.
+        sed -i '/^passwd:/s/ ldap\b//' /etc/nsswitch.conf
+        rm -rf /var/lib/vpn-router/backup/staging /var/lib/vpn-router/backup/restore \
+               /var/lib/vpn-router/pki-publish /etc/caddy/vpn-router-pki \
+               /etc/openvpn/server/vpn-router-ca.pem /etc/openvpn/server/vpn-router-crl.pem
+        rmdir --ignore-fail-on-non-empty /var/lib/vpn-router/backup /var/lib/vpn-router 2>/dev/null || true
 
         # The refresh tokens' database and role, when the package created them.
         if [ -f /etc/vpn-router/database.secret ] && command -v psql >/dev/null 2>&1; then
@@ -64,8 +74,11 @@ case "$1" in
         rm -f /etc/vpn-router/database.secret
 
         # Key material and users are not package state: /etc/vpn-router/pki,
-        # /etc/vpn-router/ldap, the user directory in slapd, the WireGuard key
-        # pair and everything under /etc/swanctl are left in place.
+        # /etc/vpn-router/ldap, /etc/vpn-router/rclone.conf, the user directory
+        # in slapd, the WireGuard key pair, everything under /etc/swanctl, the
+        # backups and what a restore replaced are left in place. Caddy stays
+        # installed, so its repository, which vpn-router-caddy configures, stays
+        # too.
         rmdir --ignore-fail-on-non-empty /etc/vpn-router 2>/dev/null || true
         ;;
 esac

debian-package/debian/prerm

@@ -17,10 +17,11 @@ case "$1" in
         fi
 
         # vpn-router-setup enabled wg-quick@wg0, openvpn-server@vpn-router,
-        # caddy and vpn-router-metrics, so the package takes them down again.
-        # Use the debhelper wrappers rather than systemctl, so the script
-        # behaves on a machine without systemd.
-        for unit in wg-quick@wg0.service openvpn-server@vpn-router.service caddy.service vpn-router-metrics.service; do
+        # caddy, vpn-router-metrics, the backup timer and the PKI timer, so the
+        # package takes them down again. Use the debhelper wrappers rather than
+        # systemctl, so the script behaves on a machine without systemd.
+        for unit in wg-quick@wg0.service openvpn-server@vpn-router.service caddy.service vpn-router-metrics.service \
+                vpn-router-backup.timer vpn-router-pki.timer; do
             if command -v deb-systemd-invoke >/dev/null 2>&1; then
                 deb-systemd-invoke stop "$unit" >/dev/null 2>&1 || true
             fi

debian-package/debian/rules

@@ -8,3 +8,6 @@ override_dh_installsystemd:
 	dh_installsystemd --name=vpn-router-web --no-start
 	dh_installsystemd --name=vpn-router-metrics --no-enable --no-start
 	dh_installsystemd --name=vpn-router-bootstrap --no-enable --no-start
+	dh_installsystemd --name=vpn-router-backup --no-enable --no-start
+	dh_installsystemd --name=vpn-router-pki --no-enable --no-start
+	dh_installsystemd --name=vpn-router-caddy --no-enable --no-start

debian-package/debian/templates

@@ -124,8 +124,7 @@ Type: boolean
 Default: false
 Description: Enable road-warrior (P2S) access?
  If enabled, this router accepts IKEv2 EAP-TLS connections from individual
- clients. Certificates are taken from /etc/vpn-router/pki, and a local
- certificate authority is created there if that directory is empty.
+ clients, with certificates of the router's P2S issuing CA.
 
 Template: vpn-router/p2s_address_pool
 Type: string
@@ -133,12 +132,12 @@ Default:
 Description: Road-warrior address pool:
  CIDR block assigned to road-warrior clients (for example 172.16.0.0/24).
 
-Template: vpn-router/p2s_ca_name
+Template: vpn-router/pki_root_name
 Type: string
-Default: VPN Router CA
-Description: Road-warrior CA name:
- Common name for the certificate authority created in /etc/vpn-router/pki
- when that directory is empty. Ignored when certificates are supplied.
+Default: VPN Router Root CA
+Description: Root CA name:
+ Common name of the root certificate authority the router creates in
+ /etc/vpn-router/pki/root. Ignored when a root certificate is placed there.
 
 Template: vpn-router/wg_enabled
 Type: boolean

debian-package/debian/vpn-router.vpn-router-backup.service

@@ -0,0 +1,11 @@
+[Unit]
+Description=VPN Router backup
+Documentation=file:/usr/share/doc/vpn-router/README.md
+After=network-online.target slapd.service postgresql.service
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/vpn-router-backup run
+Nice=10
+IOSchedulingClass=idle

debian-package/debian/vpn-router.vpn-router-backup.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=VPN Router backup schedule
+Documentation=file:/usr/share/doc/vpn-router/README.md
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target

debian-package/debian/vpn-router.vpn-router-caddy.service

@@ -0,0 +1,10 @@
+[Unit]
+Description=VPN Router Caddy installation
+Documentation=file:/usr/share/doc/vpn-router/README.md
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/vpn-router-caddy apply
+TimeoutStartSec=20min

debian-package/debian/vpn-router.vpn-router-pki.service

@@ -0,0 +1,7 @@
+[Unit]
+Description=VPN Router PKI maintenance
+Documentation=file:/usr/share/doc/vpn-router/README.md
+
+[Service]
+Type=oneshot
+ExecStart=/usr/sbin/vpn-router-ca maintain

debian-package/debian/vpn-router.vpn-router-pki.timer

@@ -0,0 +1,10 @@
+[Unit]
+Description=VPN Router PKI maintenance schedule
+Documentation=file:/usr/share/doc/vpn-router/README.md
+
+[Timer]
+OnCalendar=daily
+Persistent=true
+
+[Install]
+WantedBy=timers.target

debian-package/debian/vpn-router.vpn-router-web.service

@@ -15,7 +15,7 @@ NoNewPrivileges=yes
 ProtectSystem=strict
 RuntimeDirectory=vpn-router
 RuntimeDirectoryPreserve=yes
-ReadWritePaths=-/etc/vpn-router -/etc/swanctl/x509crl
+ReadWritePaths=-/etc/vpn-router -/etc/swanctl/x509crl -/etc/openvpn/server -/var/lib/vpn-router/pki-publish
 ProtectHome=yes
 PrivateTmp=yes
 

debian-package/src/usr/lib/vpn-router/generate-config

@@ -50,7 +50,7 @@ ANSWERS = {
     'VPN_ROUTER_PSK':             ((*FIRST, 'psk'),),
     'VPN_ROUTER_P2S_ENABLED':     (('p2s', 'enabled'),),
     'VPN_ROUTER_P2S_ADDRESS_POOL': (('p2s', 'address_pool'),),
-    'VPN_ROUTER_P2S_CA_NAME':     (('p2s', 'ca_name'),),
+    'VPN_ROUTER_PKI_ROOT_NAME':   (('pki', 'root_name'),),
     'VPN_ROUTER_WG_ENABLED':      (('wireguard', 'enabled'),),
     'VPN_ROUTER_WG_ADDRESS':      (('wireguard', 'address'),),
     'VPN_ROUTER_WG_LISTEN_PORT':  (('wireguard', 'listen_port'),),

debian-package/src/usr/lib/vpn-router/openvpn-issuer

@@ -0,0 +1,24 @@
+#!/usr/bin/python3
+"""Accept an OpenVPN client certificate only when the P2S issuing CA signed it.
+
+Run by the OpenVPN server as tls-verify for each certificate of the client's chain, with its depth and subject as the
+arguments. At depth 1, the CA that signed the client's certificate, the SHA-256 fingerprint OpenVPN gives in
+tls_digest_sha256_1 must be that of P2S_CA; the other depths are accepted.
+"""
+
+import hashlib
+import os
+import ssl
+import sys
+
+P2S_CA = '/etc/swanctl/x509ca/p2s.pem'
+
+if len(sys.argv) < 2 or sys.argv[1] != '1':
+    sys.exit(0)
+try:
+    with open(P2S_CA, encoding='ascii') as handle:
+        expected = hashlib.sha256(ssl.PEM_cert_to_DER_cert(handle.read())).hexdigest()
+except (OSError, ValueError):
+    sys.exit(1)
+given = os.environ.get('tls_digest_sha256_1', '').replace(':', '').lower()
+sys.exit(0 if given == expected else 1)

debian-package/src/usr/lib/vpn-router/setup

@@ -22,6 +22,7 @@ import os
 import pathlib
 import re
 import secrets
+import shutil
 import socket
 import subprocess
 import sys
@@ -33,8 +34,9 @@ import ldap
 
 import vpnrouter
 import vpnrouter_ldap
+import vpnrouter_pki
 import vpnrouter_users
-from vpnrouter import fail
+from vpnrouter import fail, warn
 
 BEFORE_RULES = pathlib.Path('/etc/ufw/before.rules')
 UFW_DEFAULTS = pathlib.Path('/etc/default/ufw')
@@ -63,12 +65,33 @@ MANAGER_PORT   = 7080
 #: The password of the metrics service account, which setup makes and keeps (root only).
 METRICS_SECRET = pathlib.Path('/etc/vpn-router/metrics.secret')
 
+#: The schedule of the backup timer, written from backup.schedule.
+BACKUP_SCHEDULE = pathlib.Path('/etc/systemd/system/vpn-router-backup.timer.d/schedule.conf')
+
 #: The configuration of Caddy, the HTTPS proxy, which the package's drop-in for caddy.service names;
 #: Caddy runs as the user and group CADDY_GROUP, which the caddy package creates.
 CADDYFILE   = pathlib.Path('/etc/caddy/vpn-router.Caddyfile')
 CADDY_UNIT  = 'caddy.service'
 CADDY_GROUP = 'caddy'
 
+#: The unit that installs Caddy from https.caddy_source with vpn-router-caddy, outside setup.
+CADDY_INSTALL_UNIT = 'vpn-router-caddy.service'
+
+#: The certificates and keys of the issuing CAs behind Caddy's ACME server, <name>/cert.pem and key.pem.
+CADDY_PKI_DIR = pathlib.Path('/etc/caddy/vpn-router-pki')
+
+#: The timer of vpn-router-ca maintain, which keeps the CRLs fresh.
+PKI_TIMER = 'vpn-router-pki.timer'
+
+#: The system's side of console login (vpnrouter_users.console): nslcd's configuration, which serves the posixAccounts
+#: of the directory with console login on, the name service switch, the sudo rule of their group, and the drop-in of
+#: sshd that lets them sign in with their password while ssh.ldap_login is true.
+NSLCD_CONF = pathlib.Path('/etc/nslcd.conf')
+NSSWITCH = pathlib.Path('/etc/nsswitch.conf')
+SUDOERS = pathlib.Path('/etc/sudoers.d/vpn-router')
+SSHD_DROPIN = pathlib.Path('/etc/ssh/sshd_config.d/vpn-router.conf')
+PAM_SESSION = pathlib.Path('/etc/pam.d/common-session')
+
 FILTER_ANCHOR = '# End required lines'
 
 #: Configuration options left out wherever the configuration is shown.
@@ -263,16 +286,21 @@ def filter_block(ctx):
             '# METRICS RULES END',
         ]
 
-    # Let's Encrypt reaches the HTTP challenge on the external interface; the HTTPS ports are open on both.
+    # Let's Encrypt reaches the HTTP challenge on the external interface, and the CA files published on port 80 are
+    # read on both; the HTTPS ports are open on both.
     if vpnrouter.https_ready(ctx) and interfaces:
-        ports = [port for wanted, port in ((ctx['web_enabled'], ctx['https_web_port']),
+        publish = ctx['pki_publish']
+        ports = [port for wanted, port in ((ctx['web_enabled'] or 'https' in publish or ctx['pki_acme'],
+                                            ctx['https_web_port']),
                                            (MANAGER.exists(), ctx['https_manager_port']),
-                                           (vpnrouter.metrics_ready(ctx), ctx['metrics_https_port'])) if wanted]
+                                           (vpnrouter.metrics_ready(ctx), ctx['metrics_https_port']),
+                                           ('http-80' in publish, vpnrouter.ACME_HTTP_PORT),
+                                           ('https-default' in publish, vpnrouter.HTTPS_DEFAULT_PORT)) if wanted]
         lines += [
             '',
             '# HTTPS RULES START',
             *([f'-A ufw-before-input -i {ctx["wan_iface"]} -p tcp --dport {vpnrouter.ACME_HTTP_PORT} -j ACCEPT']
-              if ctx['wan_iface'] else []),
+              if ctx['wan_iface'] and 'http-80' not in publish else []),
             *(f'-A ufw-before-input -i {name} -p tcp --dport {port} -j ACCEPT' for name in interfaces for port in ports),
             '# HTTPS RULES END',
         ]
@@ -458,14 +486,16 @@ def manage_admin():
 def manage_metrics_account(ctx):
     """Keep the service account metrics.service_account names, whose password is in METRICS_SECRET; the problem, or ''.
 
-    While metrics are enabled, setup owns the account: it adds it as a service account with a random password when
-    it is missing, and gives it a new random password, ending any lockout, when METRICS_SECRET is missing or does not
-    hold its password. A disabled account is left as it is. An account of that name that is not a service account is
-    left alone and is a problem.
+    While metrics are enabled, setup owns the account, an internal service account: it adds it as a service account
+    with a random password and the labels of vpnrouter_users.internal_accounts when it is missing, sets those labels
+    when they differ, and gives it a new random password, ending any lockout, when METRICS_SECRET is missing or does
+    not hold its password. The password of a disabled account is left as it is. An account of that name that is not a
+    service account is left alone and is a problem.
     """
     if not vpnrouter.metrics_ready(ctx):
         return ''
     name = ctx['metrics_service_account']
+    wanted = vpnrouter_users.internal_accounts().get(name, {})
     try:
         vpnrouter_users.check_name(name)
         try:
@@ -481,6 +511,8 @@ def manage_metrics_account(ctx):
                 current = None
             if current is not None and not vpnrouter_users.service(current):
                 return f'metrics.service_account: {name} is a user, not a service account'
+            if current is not None and any(vpnrouter_users.summary(current)[key] != value for key, value in wanted.items()):
+                vpnrouter_users.update_service(connection, name, wanted)
             # An administrator who disabled the account meant it; its password is left as it is.
             if current is not None and not vpnrouter_users.summary(current)['enabled']:
                 return ''
@@ -497,7 +529,7 @@ def manage_metrics_account(ctx):
                 METRICS_SECRET.chmod(0o600)
                 METRICS_SECRET.write_text(password + '\n', encoding='utf-8')
                 if current is None:
-                    vpnrouter_users.add(connection, name, password, {}, service=True)
+                    vpnrouter_users.add(connection, name, password, wanted, service=True)
                 else:
                     vpnrouter_users.passwd(connection, name, password)
                     vpnrouter_users.unlock(connection, name)
@@ -506,6 +538,93 @@ def manage_metrics_account(ctx):
     return ''
 
 
+def write_if_changed(path, text, mode=0o644):
+    """Write the file when its content differs; whether it was written."""
+    try:
+        if path.read_text(encoding='utf-8') == text:
+            return False
+    except OSError:
+        pass
+    path.write_text(text, encoding='utf-8')
+    path.chmod(mode)
+    return True
+
+
+def manage_console(cfg):
+    """Make the system serve console login; the problem, or ''.
+
+    The local group vpnrouter_ldap.CONSOLE_GROUP is created when missing, and sudo lets its members run any command
+    with their password. nslcd serves the directory's posixAccounts with console login on through the local socket,
+    and checks their passwords by binding as the user; the passwd line of the name service switch gains ldap, which
+    restarts the web service, and PAM creates a home at the first login. While ssh.ldap_login is true, sshd accepts the password of the group's members;
+    a drop-in sshd -t refuses is removed again.
+    """
+    group = vpnrouter_ldap.CONSOLE_GROUP
+    try:
+        grp.getgrnam(group)
+    except KeyError:
+        result = run(['groupadd', '--system', group], check=False)
+        if result.returncode != 0:
+            return f'the group {group} cannot be created: {result.stderr.strip()}'
+
+    rule = f'%{group} ALL=(ALL:ALL) ALL\n'
+    try:
+        if not SUDOERS.is_file() or SUDOERS.read_text(encoding='utf-8') != rule:
+            staged = SUDOERS.with_name('.vpn-router.new')
+            staged.write_text(rule, encoding='utf-8')
+            staged.chmod(0o440)
+            checked = run(['visudo', '-cf', str(staged)], check=False)
+            if checked.returncode != 0:
+                staged.unlink()
+                return f'the sudo rule of {group} is refused: {checked.stdout.strip()} {checked.stderr.strip()}'
+            staged.replace(SUDOERS)
+
+        uri = 'ldapi://' + vpnrouter_ldap.SLAPD_SOCKET.replace('/', '%2f') + '/'
+        nslcd = '\n'.join([
+            'uid nslcd',
+            'gid nslcd',
+            f'uri {uri}',
+            f'base {vpnrouter_ldap.BASE}',
+            'filter passwd (&(objectClass=posixAccount)(vpnRouterConsoleLogin=TRUE))',
+            f'nss_min_uid {vpnrouter_ldap.CONSOLE_UID_MIN}',
+            'pam_authz_search (&(objectClass=posixAccount)(uid=$username)(vpnRouterConsoleLogin=TRUE))',
+            'pam_password_prohibit_message The password is changed in the Router Manager or with vpn-router-user.',
+            '',
+        ])
+        if write_if_changed(NSLCD_CONF, nslcd, 0o640) or not unit_is_active('nslcd'):
+            os.chown(NSLCD_CONF, 0, grp.getgrnam('nslcd').gr_gid)
+            run(['systemctl', 'enable', 'nslcd'], check=False)
+            run(['systemctl', 'restart', 'nslcd'], check=False)
+
+        lines = NSSWITCH.read_text(encoding='utf-8').splitlines(keepends=True)
+        switched = [line.rstrip('\n') + ' ldap\n' if line.startswith('passwd:') and 'ldap' not in line.split() else line
+                    for line in lines]
+        if switched != lines:
+            NSSWITCH.write_text(''.join(switched), encoding='utf-8')
+            # A running process keeps the name service switch it read first, so the web service's shell would not find
+            # the console accounts of the directory until it restarts.
+            run(['systemctl', 'try-restart', 'vpn-router-web.service'], check=False)
+
+        if 'pam_mkhomedir' not in PAM_SESSION.read_text(encoding='utf-8'):
+            run(['pam-auth-update', '--enable', 'mkhomedir'], check=False)
+
+        if cfg['ssh']['ldap_login']:
+            changed = write_if_changed(SSHD_DROPIN, f'Match Group {group}\n    PasswordAuthentication yes\n')
+        else:
+            changed = SSHD_DROPIN.exists()
+            SSHD_DROPIN.unlink(missing_ok=True)
+        if changed:
+            checked = run(['sshd', '-t'], check=False)
+            if checked.returncode != 0:
+                SSHD_DROPIN.unlink(missing_ok=True)
+                return f'sshd refuses {SSHD_DROPIN}: {checked.stderr.strip()}'
+            if unit_is_active('ssh'):
+                run(['systemctl', 'reload', 'ssh'], check=False)
+    except (OSError, KeyError) as exc:
+        return f'console login cannot be set up: {exc}'
+    return ''
+
+
 def manage_openvpn(ctx, changed):
     """Run the OpenVPN server when it is configured, and stop it when it is not."""
     unit = 'openvpn-server@vpn-router'
@@ -521,13 +640,20 @@ def manage_openvpn(ctx, changed):
         run(['systemctl', 'restart', unit], check=False)
 
 
-def manage_caddy(ctx):
+def manage_caddy(cfg, ctx):
     """Run Caddy, the HTTPS proxy of the web service, the Router Manager and the metrics service, while HTTPS is ready, and stop it when not.
 
     CADDYFILE serves the web service on https.web_port, while the manager is installed the
     manager on https.manager_port, and while metrics are enabled the metrics service on
     metrics.https_port, all for wan.local_fqdn with a certificate from Let's Encrypt, and all
-    calling the service on its loopback address.
+    calling the service on its loopback address. It also serves the CA files of
+    vpnrouter_pki.PUBLISH_DIR at /pki/ on the endpoints of pki.publish that are Caddy's, and an
+    ACME server at /acme/<name>/ on https.web_port for each issuing CA with acme and a
+    certificate, whose certificate and key are copied to CADDY_PKI_DIR.
+
+    Caddy is installed by CADDY_INSTALL_UNIT, outside setup, when it is missing or when
+    https.caddy_source is upstream and Caddy's repository is not configured; the unit restarts
+    setup, whose next run serves with it.
     """
     if not vpnrouter.https_ready(ctx):
         vpnrouter.remove(CADDYFILE)
@@ -535,16 +661,47 @@ def manage_caddy(ctx):
             run(['systemctl', 'disable', '--now', CADDY_UNIT], check=False)
         return
 
+    source = cfg['https']['caddy_source']
+    if shutil.which('caddy') is None or (source == 'upstream' and not vpnrouter.CADDY_APT_SOURCE.is_file()):
+        run(['systemctl', 'start', '--no-block', CADDY_INSTALL_UNIT], check=False)
+        warn(f'Caddy is installed from the {source} source by {CADDY_INSTALL_UNIT}, which runs setup again')
+        return
+    if source == 'ubuntu' and vpnrouter.CADDY_APT_SOURCE.is_file():
+        warn("https.caddy_source ubuntu is ignored: Caddy's repository is configured, and Caddy stays upstream's")
+
     try:
         group = grp.getgrnam(CADDY_GROUP).gr_gid
     except KeyError:
         fail(f'the group {CADDY_GROUP} does not exist; is the caddy package installed?')
-    caddy_ctx = dict(ctx, manager_port=manager_port() if MANAGER.exists() else 0)
+    try:
+        credentials = {name: vpnrouter_pki.authority_files(name) for name in ctx['pki_acme']}
+    except ldap.LDAPError as exc:
+        warn(f'the ACME servers are left out: the PKI cannot be read: {exc}')
+        credentials = {}
+    acme = [name for name, files in credentials.items() if files is not None]
+    copied = False
+    for folder in (CADDY_PKI_DIR.iterdir() if CADDY_PKI_DIR.is_dir() else []):
+        if folder.name not in acme:
+            shutil.rmtree(folder)
+    for name in acme:
+        folder = CADDY_PKI_DIR / name
+        for path in (CADDY_PKI_DIR, folder):
+            path.mkdir(mode=0o750, exist_ok=True)
+            os.chown(path, 0, group)
+        for file, data in zip(('cert.pem', 'key.pem'), credentials[name]):
+            copied |= vpnrouter_pki.write(folder / file, data, 0o640)
+            os.chown(folder / file, 0, group)
+    authorities = vpnrouter.issuing_cas(cfg)
+    caddy_ctx = dict(ctx, manager_port=manager_port() if MANAGER.exists() else 0,
+                     pki_publish_dir=str(vpnrouter_pki.PUBLISH_DIR),
+                     acme_cas=[{'id': name, 'name': authorities[name]['name'].strip(),
+                                'cert': str(CADDY_PKI_DIR / name / 'cert.pem'),
+                                'key': str(CADDY_PKI_DIR / name / 'key.pem')} for name in acme])
     changed = vpnrouter.render(vpnrouter._jinja_env(), caddy_ctx, 'Caddyfile.j2', CADDYFILE, 0o640)
     os.chown(CADDYFILE, 0, group)
     if not unit_is_active(CADDY_UNIT):
         run(['systemctl', 'enable', '--now', CADDY_UNIT], check=False)
-    elif changed:
+    elif changed or copied:
         run(['systemctl', 'reload', CADDY_UNIT], check=False)
 
 
@@ -562,6 +719,27 @@ def manage_metrics(ctx):
     run(['systemctl', 'restart', unit], check=False)
 
 
+def manage_backup(cfg):
+    """Run the backup timer on backup.schedule while backups are enabled, and stop it when not.
+
+    The schedule is a drop-in of the timer, BACKUP_SCHEDULE, which replaces the OnCalendar of the shipped unit.
+    """
+    unit = 'vpn-router-backup.timer'
+    if not cfg['backup']['enabled']:
+        run(['systemctl', 'disable', '--now', unit], check=False)
+        if BACKUP_SCHEDULE.exists():
+            BACKUP_SCHEDULE.unlink()
+            run(['systemctl', 'daemon-reload'], check=False)
+        return
+    text = f'[Timer]\nOnCalendar=\nOnCalendar={cfg["backup"]["schedule"]}\n'
+    if not BACKUP_SCHEDULE.exists() or BACKUP_SCHEDULE.read_text(encoding='utf-8') != text:
+        BACKUP_SCHEDULE.parent.mkdir(parents=True, exist_ok=True)
+        BACKUP_SCHEDULE.write_text(text, encoding='utf-8')
+        run(['systemctl', 'daemon-reload'], check=False)
+        run(['systemctl', 'restart', unit], check=False)
+    run(['systemctl', 'enable', '--now', unit], check=False)
+
+
 def run_platform_setup(cfg, ctx):
     """Let the platform module apply its own state, if it defines any."""
     module = vpnrouter.platform_module(cfg)
@@ -662,14 +840,19 @@ def main():
     start_bootstrap()
     progress('running', 'configuration')
     cfg = vpnrouter.load_config()
-    ctx, changed = vpnrouter.configure(cfg)
-
-    if ctx is None:
+    if vpnrouter.deferred(cfg):
         print('vpn-router: platform is none, configuration deferred; '
               f'set general.platform in {vpnrouter.CONFIG_FILE}')
         progress('deferred', 'configuration', f'general.platform is none; set it in {vpnrouter.CONFIG_FILE}')
         return 0
 
+    # The directory holds the PKI, which the configuration needs; its problem ends setup only after every other step.
+    failed_step = 'user directory'
+    progress('running', failed_step)
+    problem = manage_directory()
+    progress('running', 'configuration')
+    ctx, changed = vpnrouter.configure(cfg)
+
     progress('running', 'routes')
     if vpnrouter.routing_ready(ctx):
         apply_routes(ctx)
@@ -701,10 +884,6 @@ def main():
     progress('running', 'WireGuard')
     manage_wireguard(ctx, changed)
 
-    # The tunnels are up before the directory and the admin, whose problem ends setup only after every other step.
-    failed_step = 'user directory'
-    progress('running', failed_step)
-    problem = manage_directory()
     if not problem:
         failed_step = 'Router Manager admin'
         progress('running', failed_step)
@@ -713,10 +892,16 @@ def main():
         failed_step = 'metrics service account'
         progress('running', failed_step)
         problem = manage_metrics_account(ctx)
+    if not problem:
+        failed_step = 'console login'
+        progress('running', failed_step)
+        problem = manage_console(cfg)
     progress('running', 'OpenVPN')
     manage_openvpn(ctx, changed)
     progress('running', 'HTTPS proxy')
-    manage_caddy(ctx)
+    manage_caddy(cfg, ctx)
+    progress('running', 'PKI timer')
+    run(['systemctl', 'enable', '--now', PKI_TIMER], check=False)
 
     if 'resolved' in changed:
         progress('running', 'resolver')
@@ -730,6 +915,8 @@ def main():
     refresh_web(cfg, ctx)
     progress('running', 'metrics service')
     manage_metrics(ctx)
+    progress('running', 'backup timer')
+    manage_backup(cfg)
     if problem:
         progress('failed', failed_step, problem)
         print(f'vpn-router: error: {problem}', file=sys.stderr)

debian-package/src/usr/lib/vpn-router/simple-ca

@@ -1,611 +0,0 @@
-#!/usr/bin/env python3
-# MIT License
-#
-# Copyright (c) 2026 Sławomir Koszewski
-#
-# Permission is hereby granted, free of charge, to any person obtaining a copy
-# of this software and associated documentation files (the "Software"), to deal
-# in the Software without restriction, including without limitation the rights
-# to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-# copies of the Software, and to permit persons to whom the Software is
-# furnished to do so, subject to the following conditions:
-#
-# The above copyright notice and this permission notice shall be included in all
-# copies or substantial portions of the Software.
-#
-# THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-# IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-# FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-# AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-# LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-# OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
-# SOFTWARE.
-
-# This module requires Python 3.8+ and OpenSSL to be installed on the system.
-
-import argparse
-import datetime
-import json
-import os
-import re
-import subprocess
-import sys
-import tempfile
-
-OPENSSL = "openssl"
-
-
-class Config:
-    FILE = "simple-ca.json"
-
-    def __init__(self, ca_dir: str):
-        self._path = os.path.join(ca_dir, self.FILE)
-        self._data: dict = {}
-        if not os.path.isfile(self._path):
-            return
-        try:
-            with open(self._path, "r") as f:
-                self._data = json.load(f)
-        except (json.JSONDecodeError, OSError) as e:
-            print(f"WARNING: could not read {self._path}: {e}", file=sys.stderr)
-
-    def get(self, key, default=None):
-        return self._data.get(key, default)
-
-    def update(self, patch: dict):
-        file_missing = not os.path.isfile(self._path)
-        changed = any(self._data.get(k) != v for k, v in patch.items())
-        if file_missing or changed:
-            self._data.update(patch)
-            self._save()
-
-    def append_history(self, ca_key: str, entry: dict):
-        history = self._data.get("history", {})
-        history.setdefault(ca_key, []).append(entry)
-        self._data["history"] = history
-        self._save()
-
-    def revoke_in_history(self, ca_key: str, serial: str, revoked_at: str):
-        """Mark a certificate as revoked. Returns True if newly revoked,
-        False if already revoked, None if serial not found."""
-        history = self._data.get("history", {})
-        for entry in history.get(ca_key, []):
-            if entry.get("serial") == serial:
-                if "revoked" in entry:
-                    return False
-                entry["revoked"] = revoked_at
-                self._data["history"] = history
-                self._save()
-                return True
-        return None
-
-    def _save(self):
-        with open(self._path, "w") as f:
-            json.dump(self._data, f, indent=2)
-            f.write("\n")
-
-
-_config: Config
-
-
-def _now() -> str:
-    return datetime.datetime.now(datetime.timezone.utc).strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-def _err(msg):
-    print(f"ERROR: {msg}", file=sys.stderr)
-
-
-def _rebuild_ca_bundle(ca_dir):
-    bundle_path = os.path.join(ca_dir, "ca_bundle.pem")
-    parts = []
-    root = os.path.join(ca_dir, "ca_cert.pem")
-    if os.path.isfile(root):
-        with open(root, "rb") as f:
-            parts.append(f.read())
-    for name in sorted(_config.get("subordinates", [])):
-        sub_cert = os.path.join(ca_dir, name, "ca_cert.pem")
-        if os.path.isfile(sub_cert):
-            with open(sub_cert, "rb") as f:
-                parts.append(f.read())
-    with open(bundle_path, "wb") as f:
-        f.write(b"".join(parts))
-
-
-def _read_serial(cert_path) -> str:
-    result = subprocess.run(
-        [OPENSSL, "x509", "-in", cert_path, "-noout", "-serial"],
-        capture_output=True, text=True,
-    )
-    return result.stdout.strip().split("=", 1)[-1]
-
-
-def _read_expiry(cert_path) -> str:
-    """Return the certificate notAfter date as an ISO 8601 UTC string."""
-    result = subprocess.run(
-        [OPENSSL, "x509", "-in", cert_path, "-noout", "-enddate"],
-        capture_output=True, text=True,
-    )
-    raw = result.stdout.strip().split("=", 1)[-1]
-    raw = " ".join(raw.split())  # normalize whitespace ("May  4" -> "May 4")
-    dt = datetime.datetime.strptime(raw, "%b %d %H:%M:%S %Y GMT")
-    return dt.strftime("%Y-%m-%dT%H:%M:%SZ")
-
-
-def _iso_to_asn1(iso: str) -> str:
-    """Convert "2026-05-24T14:28:10Z" -> "260524142810Z" for OpenSSL index.txt."""
-    dt = datetime.datetime.strptime(iso, "%Y-%m-%dT%H:%M:%SZ")
-    return dt.strftime("%y%m%d%H%M%SZ")
-
-
-_IP_RE = re.compile(r"^[0-9]{1,3}(\.[0-9]{1,3}){3}$")
-_DNS_RE = re.compile(r"^[a-z0-9-]+(\.[a-z0-9-]+)*$")
-
-
-def _is_ip(value):
-    return bool(_IP_RE.match(value))
-
-
-def _is_dns(value):
-    return bool(_DNS_RE.match(value))
-
-
-def _pipe(cmd1, cmd2):
-    p1 = subprocess.Popen(cmd1, stdout=subprocess.PIPE)
-    p2 = subprocess.Popen(cmd2, stdin=p1.stdout)
-    p1.stdout.close()
-    p2.communicate()
-    p1.wait()
-    return p1.returncode == 0 and p2.returncode == 0
-
-
-def make_ca(ca_dir, ca_name, days=3650, issuing_ca=None, ca_publish_base_url=None):
-    if issuing_ca == "ca":
-        _err("--issuing-ca cannot be 'ca' as it is reserved for the root CA.")
-        return False
-
-    if not ca_dir or not os.path.isdir(ca_dir):
-        _err(f"Certificate directory {ca_dir} does not exist.")
-        return False
-
-    if not ca_name:
-        _err("CA name is required.")
-        return False
-
-    root_ca_cert_path = os.path.join(ca_dir, "ca_cert.pem")
-    root_ca_key_path  = os.path.join(ca_dir, "ca_key.pem")
-
-    if not os.path.isfile(root_ca_cert_path) or not os.path.isfile(root_ca_key_path):
-        if issuing_ca:
-            _err(
-                f"Cannot create issuing CA '{ca_name}' without existing root CA "
-                "certificate and key. Please create the root CA first."
-            )
-            return False
-
-        print(f"Generating CA certificate '{ca_name}' and key...")
-        # Path length constraint of 1: allows one level of issuing CAs.
-        cmd = [
-            OPENSSL, "req",
-            "-x509",
-            "-newkey", "rsa:4096",
-            "-keyout", root_ca_key_path,
-            "-out", root_ca_cert_path,
-            "-days", str(days),
-            "-noenc",
-            "-subj", f"/CN={ca_name}",
-            "-text",
-            "-addext", "basicConstraints=critical,CA:TRUE,pathlen:1",
-            "-addext", "keyUsage=critical,keyCertSign,cRLSign",
-        ]
-        if subprocess.run(cmd).returncode != 0:
-            _err("Failed to generate CA certificate and key.")
-            return False
-
-        _rebuild_ca_bundle(ca_dir)
-        patch = {"name": ca_name, "created": _now()}
-        if ca_publish_base_url:
-            patch["ca_publish_base_url"] = ca_publish_base_url
-        _config.update(patch)
-        return True
-
-    issuing_ca_dir  = os.path.join(ca_dir, issuing_ca)
-    issuing_ca_cert = os.path.join(issuing_ca_dir, "ca_cert.pem")
-    issuing_ca_key  = os.path.join(issuing_ca_dir, "ca_key.pem")
-
-    if not os.path.isfile(issuing_ca_cert) or not os.path.isfile(issuing_ca_key):
-        print(f"Generating issuing CA certificate '{ca_name}' and key...")
-        os.makedirs(issuing_ca_dir, exist_ok=True)
-        req_cmd = [
-            OPENSSL, "req",
-            "-newkey", "rsa:4096",
-            "-keyout", issuing_ca_key,
-            "-noenc",
-            "-subj", f"/CN={ca_name}",
-            "-addext", "basicConstraints=critical,CA:TRUE,pathlen:0",
-            "-addext", "keyUsage=critical,keyCertSign,cRLSign",
-        ]
-        if ca_publish_base_url:
-            req_cmd += [
-                "-addext", f"authorityInfoAccess=caIssuers;URI:{ca_publish_base_url}/ca_cert.crt",
-                "-addext", f"crlDistributionPoints=URI:{ca_publish_base_url}/crl.pem",
-            ]
-        x509_cmd = [
-            OPENSSL, "x509",
-            "-req",
-            "-CA", root_ca_cert_path,
-            "-CAkey", root_ca_key_path,
-            "-copy_extensions", "copyall",
-            "-days", str(days),
-            "-text",
-            "-out", issuing_ca_cert,
-        ]
-        if not _pipe(req_cmd, x509_cmd):
-            _err("Failed to generate issuing CA certificate and key.")
-            return False
-
-    patch = {"ca_publish_base_url": ca_publish_base_url} if ca_publish_base_url else {}
-    subs = _config.get("subordinates", [])
-    if issuing_ca not in subs:
-        patch["subordinates"] = subs + [issuing_ca]
-    _config.update(patch)
-    _rebuild_ca_bundle(ca_dir)
-    return True
-
-
-def make_cert(cert_subject_name, sans=None, ca_dir=None, cert_dir=None,
-              issuing_ca=None, days=365, ca_publish_base_url=None):
-    if issuing_ca == "ca":
-        _err("--issuing-ca cannot be 'ca' as it is reserved for the root CA.")
-        return False
-
-    if not ca_dir or not os.path.isdir(ca_dir):
-        _err(f"CA directory {ca_dir} does not exist.")
-        return False
-
-    if not cert_subject_name:
-        _err("Subject name is required.")
-        return False
-
-    if not _is_dns(cert_subject_name):
-        _err(f"Invalid subject name '{cert_subject_name}'. Must be a valid DNS name.")
-        return False
-
-    signing_dir  = os.path.join(ca_dir, issuing_ca) if issuing_ca else ca_dir
-    cert_dir     = cert_dir or signing_dir
-
-    if not os.path.isdir(cert_dir):
-        _err(f"Certificate directory {cert_dir} does not exist.")
-        return False
-    ca_cert_path = os.path.join(signing_dir, "ca_cert.pem")
-    ca_key_path  = os.path.join(signing_dir, "ca_key.pem")
-    if not os.path.isfile(ca_cert_path) or not os.path.isfile(ca_key_path):
-        _err(
-            f"Signing CA certificate and key not found in {signing_dir}. "
-            "Please set up a signing CA first."
-        )
-        return False
-
-    aia_url = cdp_url = ""
-    if ca_publish_base_url:
-        if issuing_ca:
-            aia_url = f"{ca_publish_base_url}/{issuing_ca}/ca_cert.crt"
-            cdp_url = f"{ca_publish_base_url}/{issuing_ca}/crl.pem"
-        else:
-            aia_url = f"{ca_publish_base_url}/ca_cert.crt"
-            cdp_url = f"{ca_publish_base_url}/crl.pem"
-
-    cert_name = cert_subject_name.split(".", 1)[0]
-
-    san_entries = [f"DNS:{cert_subject_name}"]
-    for entry in sans or []:
-        if _is_ip(entry):
-            san_entries.append(f"IP:{entry}")
-        elif _is_dns(entry):
-            san_entries.append(f"DNS:{entry}")
-        else:
-            _err(f"Invalid SAN entry '{entry}'")
-            return False
-
-    sans_ext = "subjectAltName=" + ",".join(san_entries)
-
-    print(f"Generating server certificate for '{cert_subject_name}' with SANs:")
-    for san in san_entries:
-        print(f"  - {san}")
-
-    cert_out = os.path.join(cert_dir, f"{cert_name}_cert.pem")
-    key_out  = os.path.join(cert_dir, f"{cert_name}_key.pem")
-
-    if not os.path.isfile(cert_out) or not os.path.isfile(key_out):
-        print("Generating server certificate and key...")
-        req_cmd = [
-            OPENSSL, "req",
-            "-newkey", "rsa:4096",
-            "-keyout", key_out,
-            "-noenc",
-            "-subj", f"/CN={cert_subject_name}",
-            "-addext", "basicConstraints=critical,CA:FALSE",
-            "-addext", "keyUsage=critical,digitalSignature,keyEncipherment",
-            "-addext", "extendedKeyUsage=serverAuth,clientAuth",
-            "-addext", sans_ext,
-        ]
-        if aia_url:
-            req_cmd += ["-addext", f"authorityInfoAccess=caIssuers;URI:{aia_url}"]
-        if cdp_url:
-            req_cmd += ["-addext", f"crlDistributionPoints=URI:{cdp_url}"]
-        x509_cmd = [
-            OPENSSL, "x509",
-            "-req",
-            "-CA", ca_cert_path,
-            "-CAkey", ca_key_path,
-            "-copy_extensions", "copyall",
-            "-days", str(days),
-            "-text",
-            "-out", cert_out,
-        ]
-        if not _pipe(req_cmd, x509_cmd):
-            _err("Failed to generate server certificate and key.")
-            return False
-
-        _config.append_history(issuing_ca or "ca", {
-            "name": cert_subject_name,
-            "serial": _read_serial(cert_out),
-            "created": _now(),
-            "expires": _read_expiry(cert_out),
-        })
-
-    return True
-
-
-def make_pfx(cert_path, ca_dir, issuing_ca=None, password=None, apple_openssl=False):
-    if issuing_ca == "ca":
-        _err("--issuing-ca cannot be 'ca' as it is reserved for the root CA.")
-        return False
-
-    cert_dir      = os.path.dirname(cert_path)
-    cert_basename = os.path.basename(cert_path)
-    cert_name     = cert_basename[:-len("_cert.pem")] if cert_basename.endswith("_cert.pem") else cert_basename
-    key_path      = os.path.join(cert_dir, f"{cert_name}_key.pem")
-
-    if not cert_dir or not os.path.isdir(cert_dir):
-        _err(f"Certificate directory {cert_dir} does not exist.")
-        return False
-
-    if not ca_dir or not os.path.isdir(ca_dir):
-        _err(f"CA directory {ca_dir} does not exist.")
-        return False
-
-    if not os.path.isfile(cert_path) or not os.path.isfile(key_path):
-        _err("Server certificate or key not found.")
-        return False
-
-    root_ca_cert_path = os.path.join(ca_dir, "ca_cert.pem")
-    root_ca_key_path  = os.path.join(ca_dir, "ca_key.pem")
-    if not os.path.isfile(root_ca_cert_path) or not os.path.isfile(root_ca_key_path):
-        _err(f"CA certificate or key not found in {ca_dir}.")
-        return False
-
-    if issuing_ca:
-        issuing_ca_cert_path = os.path.join(ca_dir, issuing_ca, "ca_cert.pem")
-        if not os.path.isfile(issuing_ca_cert_path):
-            _err(f"Issuing CA certificate not found: {issuing_ca_cert_path}.")
-            return False
-
-    if not password:
-        password = "changeit"
-
-    pfx_path = os.path.join(cert_dir, f"{cert_name}.pfx")
-    if os.path.isfile(pfx_path):
-        print("PKCS#12 (PFX) file already exists, aborting generation.")
-        return False
-
-    print("Generating PKCS#12 (PFX) file...", end="")
-
-    chain_bytes = b""
-    with open(root_ca_cert_path, "rb") as f:
-        chain_bytes += f.read()
-    if issuing_ca:
-        with open(issuing_ca_cert_path, "rb") as f:
-            chain_bytes += f.read()
-
-    chain_fd, chain_file = tempfile.mkstemp()
-    try:
-        with os.fdopen(chain_fd, "wb") as f:
-            f.write(chain_bytes)
-        cmd = [
-            "/usr/bin/openssl" if apple_openssl else OPENSSL, "pkcs12",
-            "-export", "-out", pfx_path,
-            "-inkey", key_path,
-            "-in", cert_path,
-            "-certfile", chain_file,
-            "-password", f"pass:{password}",
-        ]
-        if subprocess.run(cmd).returncode != 0:
-            _err("Failed to generate PKCS#12 (PFX) file.")
-            return False
-    finally:
-        if os.path.exists(chain_file):
-            os.remove(chain_file)
-
-    print("done.")
-    return True
-
-
-def make_crl(ca_dir, issuing_ca=None, days=30):
-    signing_dir = os.path.join(ca_dir, issuing_ca) if issuing_ca else ca_dir
-    ca_cert     = os.path.join(signing_dir, "ca_cert.pem")
-    ca_key      = os.path.join(signing_dir, "ca_key.pem")
-
-    if not os.path.isfile(ca_cert) or not os.path.isfile(ca_key):
-        _err(f"CA certificate or key not found in {signing_dir}.")
-        return False
-
-    crl_path = os.path.join(signing_dir, "crl.pem")
-
-    history_key = issuing_ca or "ca"
-    revoked_entries = [
-        e for e in _config.get("history", {}).get(history_key, [])
-        if "revoked" in e and "expires" in e
-    ]
-
-    with tempfile.TemporaryDirectory() as tmp:
-        index_txt = os.path.join(tmp, "index.txt")
-        crlnumber = os.path.join(tmp, "crlnumber")
-        cnf_path  = os.path.join(tmp, "openssl.cnf")
-
-        with open(index_txt, "w") as f:
-            for e in revoked_entries:
-                expires_asn1 = _iso_to_asn1(e["expires"])
-                revoked_asn1 = _iso_to_asn1(e["revoked"])
-                f.write(f"R\t{expires_asn1}\t{revoked_asn1}\t{e['serial']}\tunknown\t/CN={e['name']}\n")
-        with open(crlnumber, "w") as f:
-            f.write("01\n")
-        with open(cnf_path, "w") as f:
-            f.write(
-                "[ ca ]\ndefault_ca = CA_default\n\n"
-                "[ CA_default ]\n"
-                f"database         = {index_txt}\n"
-                f"crlnumber        = {crlnumber}\n"
-                f"certificate      = {ca_cert}\n"
-                f"private_key      = {ca_key}\n"
-                f"default_crl_days = {days}\n"
-                "default_md       = sha256\n\n"
-                "[ crl_ext ]\n"
-                "authorityKeyIdentifier = keyid:always\n"
-            )
-
-        if subprocess.run([OPENSSL, "ca", "-gencrl", "-config", cnf_path, "-out", crl_path]).returncode != 0:
-            _err("Failed to generate CRL.")
-            return False
-
-    print(f"CRL written to {crl_path}")
-    return True
-
-
-def revoke_cert(cert_path, ca_dir, issuing_ca=None):
-    if not os.path.isfile(cert_path):
-        _err(f"Certificate not found: {cert_path}")
-        return False
-
-    signing_dir = os.path.join(ca_dir, issuing_ca) if issuing_ca else ca_dir
-    if not os.path.isdir(signing_dir):
-        _err(f"CA directory not found: {signing_dir}")
-        return False
-
-    ca_key = issuing_ca or "ca"
-    serial = _read_serial(cert_path)
-    result = _config.revoke_in_history(ca_key, serial, _now())
-
-    if result is None:
-        _err(f"Certificate with serial {serial} not found in history for CA '{ca_key}'.")
-        return False
-    if result is False:
-        print(f"Certificate {cert_path} (serial {serial}) is already revoked.")
-        return True
-
-    print(f"Certificate {cert_path} (serial {serial}) marked as revoked.")
-    return True
-
-
-def _build_parser():
-    parser = argparse.ArgumentParser(
-        description="Simple CA for creating and managing test certificates."
-    )
-    sub = parser.add_subparsers(dest="command", required=True)
-
-    p_ca = sub.add_parser("make-ca", help="Create a root or issuing CA.")
-    p_ca.add_argument("--days", type=int, default=None, help="Validity period in days (default: 3650)")
-    p_ca.add_argument("--issuing-ca", default=None, help="Specify the issuing CA")
-    p_ca.add_argument("--ca-publish-base-url", default=None,
-                      help="Base URL for AIA and CRL distribution point extensions")
-    p_ca.add_argument("--ca-dir", help="Directory to store the CA files")
-    p_ca.add_argument("--openssl", default=None, metavar="PATH",
-                      help=f"Path to the openssl binary (default: {OPENSSL})")
-    p_ca.add_argument("ca_name", help="Name of the CA")
-
-    p_cert = sub.add_parser("make-cert", help="Create a server/client certificate.")
-    p_cert.add_argument("--ca-dir", help="Directory of the CA")
-    p_cert.add_argument("--issuing-ca", default=None, help="Specify the issuing CA")
-    p_cert.add_argument("--days", type=int, default=None, help="Validity period in days (default: 365)")
-    p_cert.add_argument("--cert-dir", help="Directory to store the certificate files")
-    p_cert.add_argument("--openssl", default=None, metavar="PATH",
-                        help=f"Path to the openssl binary (default: {OPENSSL})")
-    p_cert.add_argument("subject_name", help="Subject name for the certificate")
-    p_cert.add_argument("sans", nargs="*", help="Subject Alternative Names (SANs) for the certificate")
-
-    p_pfx = sub.add_parser("make-pfx", help="Create a PKCS#12 (PFX) bundle.")
-    p_pfx.add_argument("--issuing-ca", default=None, help="Specify the issuing CA")
-    p_pfx.add_argument("--ca-dir", help="Directory of the CA")
-    p_pfx.add_argument("--password", help="Password for the PFX file")
-    p_pfx.add_argument("--apple-openssl", action="store_true", default=False,
-                       help="Use Apple's bundled /usr/bin/openssl for PKCS12 generation")
-    p_pfx.add_argument("path", help="Path to the certificate file")
-
-    p_crl = sub.add_parser("make-crl", help="Generate a CRL for a CA.")
-    p_crl.add_argument("--ca-dir", help="Directory of the CA")
-    p_crl.add_argument("--issuing-ca", default=None, help="Generate CRL for this issuing CA")
-    p_crl.add_argument("--days", type=int, default=None, help="CRL validity in days (default: 30)")
-
-    p_rev = sub.add_parser("revoke-cert", help="Revoke a certificate.")
-    p_rev.add_argument("--ca-dir", help="Directory of the CA")
-    p_rev.add_argument("--issuing-ca", default=None, help="Issuing CA that signed the certificate")
-    p_rev.add_argument("cert_path", help="Path to the certificate file to revoke")
-
-    return parser
-
-
-def main(argv=None):
-    global OPENSSL, _config
-
-    parser = _build_parser()
-    args = parser.parse_args(argv)
-    ca_dir = args.ca_dir or os.environ.get("SIMPLE_CA_DIR") or os.getcwd()
-
-    _config = Config(ca_dir)
-
-    OPENSSL             = getattr(args, "openssl", None) or _config.get("openssl", OPENSSL)
-    issuing_ca          = args.issuing_ca or _config.get("issuing_ca")
-    ca_publish_base_url = getattr(args, "ca_publish_base_url", None) or _config.get("ca_publish_base_url")
-
-    days_cfg = _config.get("days", {})
-
-    if args.command == "make-ca":
-        days = args.days or days_cfg.get("ca", 3650)
-        ok = make_ca(
-            ca_dir, args.ca_name,
-            days=days,
-            issuing_ca=issuing_ca,
-            ca_publish_base_url=ca_publish_base_url,
-        )
-    elif args.command == "make-cert":
-        days = args.days or days_cfg.get("cert", 365)
-        ok = make_cert(
-            args.subject_name,
-            sans=args.sans,
-            ca_dir=ca_dir,
-            cert_dir=getattr(args, "cert_dir", None),
-            issuing_ca=issuing_ca,
-            days=days,
-            ca_publish_base_url=ca_publish_base_url,
-        )
-    elif args.command == "make-pfx":
-        ok = make_pfx(
-            args.path, ca_dir,
-            issuing_ca=issuing_ca,
-            password=args.password,
-            apple_openssl=args.apple_openssl,
-        )
-    elif args.command == "make-crl":
-        days = args.days or days_cfg.get("crl", 30)
-        ok = make_crl(ca_dir, issuing_ca=issuing_ca, days=days)
-    elif args.command == "revoke-cert":
-        ok = revoke_cert(args.cert_path, ca_dir, issuing_ca=issuing_ca)
-    else:
-        parser.error(f"Unknown command: {args.command}")
-        ok = False
-
-    return 0 if ok else 1
-
-
-if __name__ == "__main__":
-    sys.exit(main())

debian-package/src/usr/lib/vpn-router/vpnrouter.py

@@ -12,41 +12,39 @@ import os
 import pathlib
 import re
 import shutil
-import subprocess
 import sys
 import tempfile
 import urllib.parse
 
 import jinja2
+import ldap
 
 LIB_DIR = pathlib.Path(__file__).resolve().parent
 if str(LIB_DIR) not in sys.path:
     sys.path.insert(0, str(LIB_DIR))
 
 import vpnrouter_ldap
+import vpnrouter_pki
 import vpnrouter_platforms
+import vpnrouter_status
 from vpnrouter_net import DEFAULT_LISTEN, LISTEN_CHOICES, LOOPBACK, ConfigError, detect_interfaces, interface_addresses, ip_output
 
 CONFIG_FILE  = pathlib.Path('/etc/vpn-router/vpn-router.json')
 CONFIG_LOCK  = pathlib.Path('/run/vpn-router/config.lock')
 TEMPLATE_DIR = pathlib.Path('/usr/share/vpn-router/templates')
-PKI_DIR      = pathlib.Path('/etc/vpn-router/pki')
-SIMPLE_CA    = LIB_DIR / 'simple-ca'
 
 SWANCTL_CONF_D = pathlib.Path('/etc/swanctl/conf.d')
 SITE_TO_SITE   = SWANCTL_CONF_D / 'site-to-site.conf'
 ROAD_WARRIOR   = SWANCTL_CONF_D / 'road-warrior.conf'
 P2S_FORWARDER  = pathlib.Path('/etc/systemd/resolved.conf.d/p2s-forwarder.conf')
 WG_CONF        = pathlib.Path('/etc/wireguard/wg0.conf')
+#: The router's WireGuard public key, which setup writes with its private key.
+WG_PUBLIC_KEY  = pathlib.Path('/etc/wireguard/wg0.pub')
+#: The lines around the [Peer] sections of the users' WireGuard peers in WG_CONF, which setup writes from the directory.
+WG_PEERS_BEGIN = "# BEGIN WireGuard peers of the users of the router's directory"
+WG_PEERS_END   = "# END WireGuard peers of the users of the router's directory"
 OPENVPN_CONF   = pathlib.Path('/etc/openvpn/server/vpn-router.conf')
 OPENVPN_LDAP   = pathlib.Path('/etc/openvpn/server/vpn-router-ldap.conf')
-USER_CERT_DIR  = PKI_DIR / 'users'
-
-CA_CERT_DEST   = pathlib.Path('/etc/swanctl/x509ca/ca.pem')
-SERVER_CERT    = pathlib.Path('/etc/swanctl/x509/server.pem')
-SERVER_KEY     = pathlib.Path('/etc/swanctl/private/server.key')
-CRL_DEST       = pathlib.Path('/etc/swanctl/x509crl/crl.pem')
-TRUST_ANCHOR   = pathlib.Path('/usr/local/share/ca-certificates/vpn-router-ca.crt')
 
 # section -> option -> default; the type of the default is the required type.
 SCHEMA = {
@@ -55,21 +53,35 @@ SCHEMA = {
     'wan':        {'local_fqdn': ''},
     'local':      {'cidrs': [], 'int_addr': '', 'int_gateway_ip': ''},
     'site_to_site': {},
-    'p2s':        {'enabled': False, 'address_pool': '', 'ca_name': 'VPN Router CA'},
+    'p2s':        {'enabled': False, 'address_pool': ''},
     'wireguard':  {'enabled': False, 'address': '', 'listen_port': 51820},
     'openvpn':    {'enabled': False, 'address_pool': '', 'port': 1194, 'protocol': 'udp'},
     'docker':     {'mode': 'auto', 'exposed_ports': []},
     'web':        {'enabled': True, 'listen': DEFAULT_LISTEN, 'port': 7081, 'database': '', 'trusted_proxies': [],
-                   'status_content': 'basic'},
-    'https':      {'enabled': True, 'email': '', 'web_port': 7444, 'manager_port': 7443},
+                   'status_content': 'basic', 'shell': False, 'shell_idle_minutes': 15},
+    'ssh':        {'ldap_login': False},
+    'https':      {'enabled': True, 'email': '', 'web_port': 7444, 'manager_port': 7443, 'caddy_source': 'ubuntu'},
+    'pki':        {'root_name': 'VPN Router Root CA', 'root_days': 7300, 'ca_days': 3650, 'key': 'rsa-4096',
+                   'crl_days': 7, 'root_crl_days': 180, 'publish': ['http'], 'p2s_name': 'VPN Router P2S CA',
+                   's2s_name': 'VPN Router Site-to-Site CA', 'issuing_cas': {}, 'templates': {},
+                   'extended_key_usages': {}, 'root_key_warning': True},
     'metrics':    {'enabled': True, 'listen': 'internal', 'port': 9464, 'https_port': 9465, 'service_account': 'metrics',
                    'otlp_endpoint': '', 'otlp_username': '', 'otlp_password': '',
                    'keep_details': '24 hours', 'keep_hourly': '1 month', 'keep_daily': '3 months',
                    'keep_monthly': '1 year', 'keep_yearly': '10 years'},
+    'backup':     {'enabled': False, 'schedule': 'daily', 'target': 'local', 'path': '/var/backups/vpn-router',
+                   'keep_hourly': 24, 'keep_daily': 7, 'keep_weekly': 4, 'keep_monthly': 12, 'keep_yearly': 0,
+                   'metrics': False, 'rclone_remote': '', 'rclone_mode': 'sync',
+                   'pbs_repository': '', 'pbs_password': '', 'pbs_fingerprint': '', 'pbs_namespace': '',
+                   'pbs_keyfile': ''},
 }
 
 #: site_to_site maps a connection name to its settings: option -> default, the type of the default being the required type.
-CONNECTION = {'addrs': [], 'id': '', 'cidrs': [], 'local_cidrs': [], 'local_id_mode': 'fqdn', 'psk': '', 'psk_file': ''}
+CONNECTION = {'addrs': [], 'id': '', 'cidrs': [], 'local_cidrs': [], 'local_id_mode': 'fqdn', 'auth': 'psk', 'psk': '',
+              'psk_file': '', 'remote_ca': ''}
+
+#: How a site_to_site connection authenticates: a pre-shared key, or certificates.
+CONNECTION_AUTH = ('psk', 'certificate')
 
 #: The name of a site_to_site connection, which also names its swanctl connection, child and secret.
 CONNECTION_NAME = re.compile(r'^[a-z][a-z0-9-]{0,30}$')
@@ -83,12 +95,115 @@ METRICS_KEEP = ('keep_details', 'keep_hourly', 'keep_daily', 'keep_monthly', 'ke
 #: A retention period as PostgreSQL reads an interval: a count and a unit.
 METRICS_INTERVAL = re.compile(r'^[1-9]\d{0,4} (hour|day|month|year)s?$')
 
+#: How often backups run, as systemd OnCalendar shorthands, from the most to the least often.
+BACKUP_SCHEDULES = ('hourly', 'daily', 'weekly')
+
+#: Where backups go: an archive in backup.path, or a Proxmox Backup Server.
+BACKUP_TARGETS = ('local', 'pbs')
+
+#: How rclone follows backup.path in the cloud: sync mirrors it, copy deletes nothing remotely.
+RCLONE_MODES = ('sync', 'copy')
+
+#: The retention settings of local backups, from the hourly to the yearly ones.
+BACKUP_KEEP = ('keep_hourly', 'keep_daily', 'keep_weekly', 'keep_monthly', 'keep_yearly')
+
+#: A remote of rclone.conf and an optional path: remote:path.
+RCLONE_REMOTE = re.compile(r'^[\w.][\w. -]*:\S*$')
+
+#: A PBS repository: [[auth-id@]server[:port]:]datastore.
+PBS_REPOSITORY = re.compile(r'^(\S+:)?[A-Za-z0-9_][A-Za-z0-9._-]*$')
+
+#: The SHA-256 fingerprint of a server certificate, as PBS shows it.
+PBS_FINGERPRINT = re.compile(r'^([0-9A-Fa-f]{2}:){31}[0-9A-Fa-f]{2}$')
+
+#: A PBS namespace: up to seven names joined by /.
+PBS_NAMESPACE = re.compile(r'^[A-Za-z0-9_][A-Za-z0-9._-]*(/[A-Za-z0-9_][A-Za-z0-9._-]*){0,6}$')
+
 #: The port of Let's Encrypt's HTTP challenge, which Caddy answers while HTTPS is on.
 ACME_HTTP_PORT = 80
 
+#: The default port of HTTPS, where Caddy publishes the CA files when pki.publish has https-default.
+HTTPS_DEFAULT_PORT = 443
+
+#: Where vpn-router-setup installs Caddy from, https.caddy_source: the Ubuntu archive or Caddy's own repository.
+CADDY_SOURCES = ('ubuntu', 'upstream')
+
+#: Caddy's own repository, which https.caddy_source upstream configures: the source, its signing key and their URLs.
+CADDY_APT_SOURCE = pathlib.Path('/etc/apt/sources.list.d/caddy-stable.sources')
+CADDY_KEYRING    = pathlib.Path('/etc/apt/keyrings/caddy-stable.asc')
+CADDY_KEY_URL    = 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key'
+CADDY_REPOSITORY = 'https://dl.cloudsmith.io/public/caddy/stable/deb/debian'
+
+#: The key types of the CAs, pki.key, and of the templates.
+PKI_KEYS = ('rsa-2048', 'rsa-3072', 'rsa-4096', 'ec-p256', 'ec-p384')
+
+#: Where the CA certificates and CRLs are published, pki.publish, as the URLs in the certificates list them.
+PKI_PUBLISH = ('http', 'http-80', 'https', 'https-default')
+
+#: The key usages a template may give, as the arguments of cryptography's KeyUsage.
+KEY_USAGES = ('digital_signature', 'content_commitment', 'key_encipherment', 'data_encipherment', 'key_agreement')
+
+#: The built-in extended key usages a template may give, name -> OID; pki.extended_key_usages adds custom ones.
+EXTENDED_KEY_USAGES = {
+    'server_auth': '1.3.6.1.5.5.7.3.1',
+    'client_auth': '1.3.6.1.5.5.7.3.2',
+    'code_signing': '1.3.6.1.5.5.7.3.3',
+    'email_protection': '1.3.6.1.5.5.7.3.4',
+    'time_stamping': '1.3.6.1.5.5.7.3.8',
+    'ocsp_signing': '1.3.6.1.5.5.7.3.9',
+    'ipsec_ike': '1.3.6.1.5.5.7.3.17',
+    'ike_intermediate': '1.3.6.1.5.5.8.2.2',
+}
+
+#: The name of a custom extended key usage of pki.extended_key_usages.
+EKU_NAME = re.compile(r'^[a-z][a-z0-9_-]{0,30}$')
+
+#: An object identifier in dotted form, of a custom extended key usage or a certificate policy.
+OID = re.compile(r'^[0-2](\.(0|[1-9][0-9]*)){1,63}$')
+
+#: What the common name of a template's certificates is: a DNS name, any name, or an e-mail address.
+TEMPLATE_SUBJECTS = ('dns', 'name', 'email')
+
+#: The subject alternative names a template's certificates may have.
+SAN_TYPES = ('dns', 'ip', 'email')
+
+#: A certificate template: option -> default, the type of the default being the required type.
+TEMPLATE = {'key': 'rsa-3072', 'days': 365, 'key_usage': ['digital_signature'], 'extended_key_usage': [],
+            'subject': 'name', 'sans': [], 'policies': []}
+
+#: The built-in templates; pki.templates changes their options and adds templates of its own.
+PKI_TEMPLATES = {
+    'vpn-server':   {'key_usage': ['digital_signature', 'key_encipherment'],
+                     'extended_key_usage': ['server_auth', 'ike_intermediate'], 'subject': 'dns', 'sans': ['dns', 'ip']},
+    'vpn-user':     {'extended_key_usage': ['client_auth'], 'subject': 'name', 'sans': ['dns', 'email']},
+    'site-to-site': {'key_usage': ['digital_signature', 'key_encipherment'],
+                     'extended_key_usage': ['server_auth', 'client_auth'], 'subject': 'dns', 'sans': ['dns', 'ip']},
+    'server':       {'key_usage': ['digital_signature', 'key_encipherment'], 'extended_key_usage': ['server_auth'],
+                     'subject': 'dns', 'sans': ['dns', 'ip']},
+    'client':       {'extended_key_usage': ['client_auth'], 'subject': 'name', 'sans': ['dns', 'email']},
+}
+
+#: The templates only the router issues: its VPN server certificate and the users' certificates.
+ROUTER_TEMPLATES = ('vpn-server', 'vpn-user')
+
+#: The built-in issuing CAs: name -> the pki option of the common name and the templates the CA issues.
+BUILTIN_CAS = {'p2s': ('p2s_name', ['vpn-server', 'vpn-user']), 's2s': ('s2s_name', ['site-to-site'])}
+
+#: A general-purpose issuing CA of pki.issuing_cas: option -> default, the type of the default being the required type.
+ISSUING_CA = {'name': '', 'templates': [], 'acme': False}
+
+#: The name of an issuing CA or a template; an issuing CA's name also names its files.
+PKI_NAME = re.compile(r'^[a-z][a-z0-9-]{0,30}$')
+
+#: The longest common name of a CA, in characters.
+CA_NAME_MAX = 64
+
 #: What / and /status of the web service show, web.status_content, from the least to the most.
 STATUS_CONTENTS = ('basic', 'standard', 'full')
 
+#: The longest web.shell_idle_minutes, a day.
+SHELL_IDLE_MAX = 1440
+
 DOCKER_MODES = ('auto', 'on', 'off')
 
 OPENVPN_PROTOCOLS = ('udp', 'tcp')
@@ -96,9 +211,6 @@ OPENVPN_PROTOCOLS = ('udp', 'tcp')
 #: The tun device of the OpenVPN server.
 OPENVPN_DEVICE = 'ovpn0'
 
-#: Days a certificate revocation list is valid; the router only reads its own lists.
-CRL_DAYS = 3650
-
 #: A port or a port range as iptables multiport takes it: 443 or 8000:8100.
 DOCKER_PORT = re.compile(r'^\d{1,5}(:\d{1,5})?$')
 
@@ -308,6 +420,10 @@ def validate(cfg):
                 f'{prefix}.local_id_mode: {id_mode!r} is not one of {", ".join(ID_MODES)}')
         _check_networks(_clean(connection['cidrs']), f'{prefix}.cidrs')
         _check_networks(_clean(connection['local_cidrs']), f'{prefix}.local_cidrs')
+        if connection['auth'] not in CONNECTION_AUTH:
+            raise ConfigError(f'{prefix}.auth: {connection["auth"]!r} is not one of {", ".join(CONNECTION_AUTH)}')
+        if connection['remote_ca'].strip() and not vpnrouter_pki.is_ca_certificate(connection['remote_ca']):
+            raise ConfigError(f'{prefix}.remote_ca is not the PEM certificate of a CA')
 
     for option, value in identities:
         if value.startswith('@'):
@@ -325,6 +441,9 @@ def validate(cfg):
                 raise ValueError
         except ValueError:
             raise ConfigError(f'openvpn.address_pool: {openvpn_pool!r} is not an IPv4 network')
+    for system, option in (('p2s', 'address_pool'), ('openvpn', 'address_pool'), ('wireguard', 'address')):
+        if _get(cfg, system, 'enabled') and not _get(cfg, system, option):
+            raise ConfigError(f'{system}.enabled needs {system}.{option}')
     _check_address(_get(cfg, 'local', 'int_addr'), 'local.int_addr')
     _check_address(_get(cfg, 'local', 'int_gateway_ip'), 'local.int_gateway_ip')
 
@@ -339,10 +458,16 @@ def validate(cfg):
     wg_address = _get(cfg, 'wireguard', 'address')
     if wg_address:
         try:
-            ipaddress.ip_interface(wg_address)
+            interface = ipaddress.ip_interface(wg_address)
         except ValueError:
             raise ConfigError(
                 f'wireguard.address: {wg_address!r} is not an address with prefix')
+        # The router's own address on wg0, from which the peers' addresses of the same network are told apart.
+        network = interface.network
+        if network.num_addresses > 2 and interface.ip in (network.network_address, network.broadcast_address):
+            raise ConfigError(
+                f'wireguard.address: {wg_address} is the network or broadcast address of {network}; give the '
+                f'router\'s own address in it, such as {next(network.hosts())}/{network.prefixlen}')
 
     port = _get(cfg, 'wireguard', 'listen_port')
     if not 1 <= port <= 65535:
@@ -371,6 +496,10 @@ def validate(cfg):
         raise ConfigError(
             f'web.status_content: {status_content!r} is not one of {", ".join(STATUS_CONTENTS)}')
 
+    shell_idle = _get(cfg, 'web', 'shell_idle_minutes')
+    if not 1 <= shell_idle <= SHELL_IDLE_MAX:
+        raise ConfigError(f'web.shell_idle_minutes: {shell_idle} is not between 1 and {SHELL_IDLE_MAX}')
+
     https_ports = []
     for option in ('web_port', 'manager_port'):
         port = _get(cfg, 'https', option)
@@ -385,8 +514,100 @@ def validate(cfg):
     for item in _get_list(cfg, 'web', 'trusted_proxies'):
         _check_address(item, 'web.trusted_proxies')
 
+    caddy_source = _get(cfg, 'https', 'caddy_source')
+    if caddy_source not in CADDY_SOURCES:
+        raise ConfigError(f'https.caddy_source: {caddy_source!r} is not one of {", ".join(CADDY_SOURCES)}')
+
+    for option in ('root_name', 'p2s_name', 's2s_name'):
+        value = _get(cfg, 'pki', option)
+        if not value or len(value) > CA_NAME_MAX or not value.isprintable():
+            raise ConfigError(f'pki.{option} must have 1 to {CA_NAME_MAX} printable characters')
+    for option in ('root_days', 'ca_days', 'crl_days', 'root_crl_days'):
+        if not 1 <= _get(cfg, 'pki', option) <= 36500:
+            raise ConfigError(f'pki.{option} must be 1 to 36500 days')
+    if _get(cfg, 'pki', 'key') not in PKI_KEYS:
+        raise ConfigError(f'pki.key: {_get(cfg, "pki", "key")!r} is not one of {", ".join(PKI_KEYS)}')
+    publish = _get_list(cfg, 'pki', 'publish')
+    for item in publish:
+        if item not in PKI_PUBLISH:
+            raise ConfigError(f'pki.publish: {item!r} is not one of {", ".join(PKI_PUBLISH)}')
+    if len(set(publish)) != len(publish):
+        raise ConfigError('pki.publish names an endpoint twice')
+    if publish and not _get(cfg, 'wan', 'local_fqdn'):
+        raise ConfigError('pki.publish needs wan.local_fqdn, the name in the published URLs')
+    if 'http' in publish and not _get(cfg, 'web', 'enabled'):
+        raise ConfigError('pki.publish: http is served by the web service, which needs web.enabled')
+    if set(publish) - {'http'} and not _get(cfg, 'https', 'enabled'):
+        raise ConfigError('pki.publish: http-80, https and https-default are served by Caddy, which needs https.enabled')
+    for name, oid in cfg['pki']['extended_key_usages'].items():
+        prefix = f'pki.extended_key_usages.{name}'
+        if not EKU_NAME.match(name) or name in EXTENDED_KEY_USAGES:
+            raise ConfigError(f'{prefix}: an extended key usage name starts with a lowercase letter, has at most 31 '
+                              'lowercase letters, digits, hyphens and underscores, and is not a built-in one')
+        if not isinstance(oid, str) or not OID.match(oid):
+            raise ConfigError(f'{prefix} must be an OID in dotted form, such as 1.3.6.1.4.1.311.20.2.2')
+    usages = extended_key_usages(cfg)
+    for name, template in cfg['pki']['templates'].items():
+        prefix = f'pki.templates.{name}'
+        if not PKI_NAME.match(name):
+            raise ConfigError(f'{prefix}: a template name starts with a lowercase letter and has at most 31 lowercase '
+                              'letters, digits and hyphens')
+        if not isinstance(template, dict):
+            raise ConfigError(f'{prefix} must be {TYPE_NAMES[dict]}')
+        _check_options(template, TEMPLATE, prefix)
+    templates = pki_templates(cfg)
+    for name, template in templates.items():
+        prefix = f'pki.templates.{name}'
+        if template['key'] not in PKI_KEYS:
+            raise ConfigError(f'{prefix}.key: {template["key"]!r} is not one of {", ".join(PKI_KEYS)}')
+        if not 1 <= template['days'] <= 36500:
+            raise ConfigError(f'{prefix}.days must be 1 to 36500 days')
+        for option, allowed in (('key_usage', KEY_USAGES), ('extended_key_usage', tuple(usages)),
+                                ('sans', SAN_TYPES)):
+            for item in template[option]:
+                if item not in allowed:
+                    raise ConfigError(f'{prefix}.{option}: {item!r} is not one of {", ".join(allowed)}')
+        for item in template['policies']:
+            if not OID.match(item):
+                raise ConfigError(f'{prefix}.policies: {item!r} is not an OID in dotted form, such as 1.3.6.1.4.1.99999.1')
+        if not template['key_usage']:
+            raise ConfigError(f'{prefix}.key_usage needs at least one usage')
+        if template['subject'] not in TEMPLATE_SUBJECTS:
+            raise ConfigError(f'{prefix}.subject: {template["subject"]!r} is not one of {", ".join(TEMPLATE_SUBJECTS)}')
+    for name, authority in cfg['pki']['issuing_cas'].items():
+        prefix = f'pki.issuing_cas.{name}'
+        if not PKI_NAME.match(name) or name in BUILTIN_CAS or name == 'root':
+            raise ConfigError(f'{prefix}: an issuing CA name starts with a lowercase letter and has at most 31 '
+                              f'lowercase letters, digits and hyphens, and is not root, {" or ".join(BUILTIN_CAS)}')
+        if not isinstance(authority, dict):
+            raise ConfigError(f'{prefix} must be {TYPE_NAMES[dict]}')
+        _check_options(authority, ISSUING_CA, prefix)
+    for name, authority in issuing_cas(cfg).items():
+        prefix = f'pki.issuing_cas.{name}'
+        if authority['builtin']:
+            continue
+        common_name = authority['name'].strip()
+        if not common_name or len(common_name) > CA_NAME_MAX or not common_name.isprintable():
+            raise ConfigError(f'{prefix}.name must have 1 to {CA_NAME_MAX} printable characters')
+        if not authority['templates']:
+            raise ConfigError(f'{prefix}.templates needs at least one template')
+        for template in authority['templates']:
+            if template not in templates:
+                raise ConfigError(f'{prefix}.templates: {template!r} is not a template')
+            if template in ROUTER_TEMPLATES:
+                raise ConfigError(f'{prefix}.templates: {template} is issued by the P2S CA only')
+        if authority['acme'] and not _get(cfg, 'https', 'enabled'):
+            raise ConfigError(f'{prefix}.acme: the ACME server is Caddy\'s, which needs https.enabled')
+
     taken = {web_port: 'web.port', ACME_HTTP_PORT: 'the HTTP challenge',
              https_ports[0]: 'https.web_port', https_ports[1]: 'https.manager_port'}
+    if 'https-default' in publish:
+        if HTTPS_DEFAULT_PORT in taken:
+            raise ConfigError(f'pki.publish: https-default takes port {HTTPS_DEFAULT_PORT}, the port of '
+                              f'{taken[HTTPS_DEFAULT_PORT]}')
+        if _get(cfg, 'openvpn', 'protocol') == 'tcp' and _get(cfg, 'openvpn', 'port') == HTTPS_DEFAULT_PORT:
+            raise ConfigError(f'pki.publish: https-default takes port {HTTPS_DEFAULT_PORT}, the port of openvpn.port')
+        taken[HTTPS_DEFAULT_PORT] = 'pki.publish https-default'
     for option in ('port', 'https_port'):
         port = _get(cfg, 'metrics', option)
         if isinstance(port, bool) or not isinstance(port, int) or not 1 <= port <= 65535:
@@ -412,6 +633,46 @@ def validate(cfg):
             raise ConfigError(
                 f'metrics.{option}: {keep!r} is not a count and a unit, such as "24 hours" or "3 months"')
 
+    schedule = _get(cfg, 'backup', 'schedule')
+    if schedule not in BACKUP_SCHEDULES:
+        raise ConfigError(
+            f'backup.schedule: {schedule!r} is not one of {", ".join(BACKUP_SCHEDULES)}')
+    target = _get(cfg, 'backup', 'target')
+    if target not in BACKUP_TARGETS:
+        raise ConfigError(f'backup.target: {target!r} is not one of {", ".join(BACKUP_TARGETS)}')
+    for option in ('path', 'pbs_keyfile'):
+        value = _get(cfg, 'backup', option)
+        if value and not value.startswith('/'):
+            raise ConfigError(f'backup.{option}: {value!r} is not an absolute path')
+    if not _get(cfg, 'backup', 'path'):
+        raise ConfigError('backup.path is required')
+    for option in BACKUP_KEEP:
+        if _get(cfg, 'backup', option) < 0:
+            raise ConfigError(f'backup.{option} must not be negative')
+    if target == 'local' and not any(_get(cfg, 'backup', option) for option in backup_keeps(schedule)):
+        raise ConfigError(
+            f'backup: with the {schedule} schedule, at least one of {", ".join(backup_keeps(schedule))} '
+            'is above 0')
+    remote = _get(cfg, 'backup', 'rclone_remote')
+    if remote and not RCLONE_REMOTE.match(remote):
+        raise ConfigError(f'backup.rclone_remote: {remote!r} is not a remote and a path, such as azure:backups/router')
+    rclone_mode = _get(cfg, 'backup', 'rclone_mode')
+    if rclone_mode not in RCLONE_MODES:
+        raise ConfigError(f'backup.rclone_mode: {rclone_mode!r} is not one of {", ".join(RCLONE_MODES)}')
+    if target == 'pbs':
+        repository = _get(cfg, 'backup', 'pbs_repository')
+        if not repository or not _get(cfg, 'backup', 'pbs_password'):
+            raise ConfigError('backup.pbs_repository and backup.pbs_password are required with the pbs target')
+        if not PBS_REPOSITORY.match(repository):
+            raise ConfigError(
+                f'backup.pbs_repository: {repository!r} is not of the form user@realm!token@host:datastore')
+    fingerprint = _get(cfg, 'backup', 'pbs_fingerprint')
+    if fingerprint and not PBS_FINGERPRINT.match(fingerprint):
+        raise ConfigError(f'backup.pbs_fingerprint: {fingerprint!r} is not 32 hexadecimal pairs joined by colons')
+    namespace = _get(cfg, 'backup', 'pbs_namespace')
+    if namespace and not PBS_NAMESPACE.match(namespace):
+        raise ConfigError(f'backup.pbs_namespace: {namespace!r} is not up to seven names joined by /')
+
     docker_mode = _get(cfg, 'docker', 'mode')
     if docker_mode not in DOCKER_MODES:
         raise ConfigError(
@@ -427,7 +688,8 @@ def validate(cfg):
         weight += 2 if ':' in item else 1
         first, _, last = item.partition(':')
         if _get(cfg, 'https', 'enabled'):
-            for port in (ACME_HTTP_PORT, *https_ports):
+            caddy_ports = (ACME_HTTP_PORT, *https_ports, *([HTTPS_DEFAULT_PORT] if 'https-default' in publish else []))
+            for port in caddy_ports:
                 if int(first) <= port <= int(last or first):
                     raise ConfigError(
                         f'docker.exposed_ports: {item!r} takes port {port}, which Caddy serves while '
@@ -438,6 +700,49 @@ def validate(cfg):
             'a range counting as two')
 
 
+def backup_keeps(schedule):
+    """The retention settings of local backups that apply to the schedule: none finer than it."""
+    return BACKUP_KEEP[BACKUP_SCHEDULES.index(schedule):]
+
+
+def pki_templates(cfg):
+    """The certificate templates: the built-in ones (PKI_TEMPLATES) and those of pki.templates, each filled from TEMPLATE."""
+    custom = cfg['pki']['templates']
+    return {name: {**TEMPLATE, **PKI_TEMPLATES.get(name, {}),
+                   **(custom.get(name) if isinstance(custom.get(name), dict) else {})}
+            for name in [*PKI_TEMPLATES, *(name for name in custom if name not in PKI_TEMPLATES)]}
+
+
+def extended_key_usages(cfg):
+    """The extended key usages templates may give, name -> OID: the built-in ones (EXTENDED_KEY_USAGES) and those of
+    pki.extended_key_usages."""
+    custom = cfg['pki']['extended_key_usages']
+    return {**EXTENDED_KEY_USAGES, **{name: oid for name, oid in custom.items() if isinstance(oid, str)}}
+
+
+def issuing_cas(cfg):
+    """The issuing CAs, name -> {name, templates, acme, builtin}: p2s and s2s (BUILTIN_CAS) with their common names from
+    the pki section, then those of pki.issuing_cas, each filled from ISSUING_CA."""
+    found = {name: {'name': _get(cfg, 'pki', option), 'templates': list(templates), 'acme': False, 'builtin': True}
+             for name, (option, templates) in BUILTIN_CAS.items()}
+    for name, options in cfg['pki']['issuing_cas'].items():
+        if isinstance(options, dict):
+            found[name] = {**ISSUING_CA, **options, 'builtin': False}
+    return found
+
+
+def pki_base_urls(cfg):
+    """The base URLs, ending in /, under which the CA certificates and CRLs are published, in the order of pki.publish."""
+    fqdn = _get(cfg, 'wan', 'local_fqdn')
+    bases = {
+        'http': f'http://{fqdn}:{_get(cfg, "web", "port")}/pki/',
+        'http-80': f'http://{fqdn}/pki/',
+        'https': f'https://{fqdn}:{_get(cfg, "https", "web_port")}/pki/',
+        'https-default': f'https://{fqdn}/pki/',
+    }
+    return [bases[item] for item in _get_list(cfg, 'pki', 'publish') if item in bases] if fqdn else []
+
+
 def resolve_psk(connection, name):
     """Return the pre-shared key of the site_to_site connection: psk_file wins, else psk; '' when none is configured."""
     psk_file = connection['psk_file'].strip()
@@ -552,6 +857,7 @@ def build_context(cfg, public_ip=None):
         id_mode = connection['local_id_mode'].strip() or 'fqdn'
         remote_cidrs = _clean(connection['cidrs'])
         connection_cidrs = _clean(connection['local_cidrs'])
+        auth = connection['auth']
         entry = {
             'name':             name,
             'remote_addrs':     ', '.join(_clean(connection['addrs'])),
@@ -562,10 +868,13 @@ def build_context(cfg, public_ip=None):
             'local_cidr_list':  connection_cidrs,
             'local_id_mode':    id_mode,
             'local_id':         identities.get(id_mode, ''),
-            'psk':              resolve_psk(connection, name),
+            'auth':             auth,
+            'psk':              resolve_psk(connection, name) if auth == 'psk' else '',
+            'remote_cacert':    vpnrouter_pki.remote_ca_file(name) if connection['remote_ca'].strip()
+                                else vpnrouter_pki.SWANCTL_CA_FILES['s2s'],
         }
-        entry['ready'] = bool(local_addrs and connection_cidrs and all(
-            entry[key] for key in ('remote_addrs', 'remote_id', 'remote_cidrs', 'local_id', 'psk')))
+        required = ('remote_addrs', 'remote_id', 'remote_cidrs', 'local_id', *(('psk',) if auth == 'psk' else ()))
+        entry['ready'] = bool(local_addrs and connection_cidrs and all(entry[key] for key in required))
         connections.append(entry)
 
     return {
@@ -584,11 +893,13 @@ def build_context(cfg, public_ip=None):
         'connections':     connections,
         'p2s_enabled':     _get(cfg, 'p2s', 'enabled'),
         'p2s_address_pool': _get(cfg, 'p2s', 'address_pool'),
-        'p2s_ca_name':     _get(cfg, 'p2s', 'ca_name'),
+        'public_ip':       public_ip or '',
         'p2s_dns':         _join(local_addrs, _split_list(extras['EXTRA_P2S_DNS'])),
         'wg_enabled':      _get(cfg, 'wireguard', 'enabled'),
         'wg_address':      _get(cfg, 'wireguard', 'address'),
         'wg_listen_port':  _get(cfg, 'wireguard', 'listen_port'),
+        'wg_peers_begin':  WG_PEERS_BEGIN,
+        'wg_peers_end':    WG_PEERS_END,
         'openvpn_enabled': _get(cfg, 'openvpn', 'enabled'),
         'openvpn_pool':    openvpn_pool,
         'openvpn_network': str(openvpn_network.network_address) if openvpn_network else '',
@@ -599,11 +910,14 @@ def build_context(cfg, public_ip=None):
         'openvpn_protocol': _get(cfg, 'openvpn', 'protocol'),
         'openvpn_device':  OPENVPN_DEVICE,
         'openvpn_ldap_conf': str(OPENVPN_LDAP),
+        'openvpn_status':  vpnrouter_status.OPENVPN_STATUS,
+        'openvpn_status_seconds': vpnrouter_status.OPENVPN_STATUS_SECONDS,
         'p2s_dns_list':    _split_list(_join(local_addrs, _split_list(extras['EXTRA_P2S_DNS']))),
-        'ca_cert':         str(CA_CERT_DEST),
-        'server_cert':     str(SERVER_CERT),
-        'server_key':      str(SERVER_KEY),
-        'crl':             str(CRL_DEST),
+        'openvpn_ca':      str(vpnrouter_pki.OPENVPN_CA),
+        'openvpn_crl':     str(vpnrouter_pki.OPENVPN_CRL),
+        'server_cert':     str(vpnrouter_pki.VPN_SERVER_CERT),
+        'server_key':      str(vpnrouter_pki.VPN_SERVER_KEY),
+        'server_certificate': False,
         'ldap_uri':        vpnrouter_ldap.URI,
         'ldap_users':      vpnrouter_ldap.USERS,
         'web_enabled':     _get(cfg, 'web', 'enabled'),
@@ -612,6 +926,8 @@ def build_context(cfg, public_ip=None):
         'https_email':     _get(cfg, 'https', 'email'),
         'https_web_port':  _get(cfg, 'https', 'web_port'),
         'https_manager_port': _get(cfg, 'https', 'manager_port'),
+        'pki_publish':     _get_list(cfg, 'pki', 'publish'),
+        'pki_acme':        [name for name, authority in issuing_cas(cfg).items() if authority['acme']],
         'metrics_enabled': _get(cfg, 'metrics', 'enabled'),
         'metrics_port':    _get(cfg, 'metrics', 'port'),
         'metrics_https_port': _get(cfg, 'metrics', 'https_port'),
@@ -632,7 +948,8 @@ def routing_ready(ctx):
 
 
 def p2s_ready(ctx):
-    return bool(ctx['p2s_enabled'] and ctx['p2s_address_pool'] and ctx['local_fqdn'])
+    """Road-warrior access needs its settings and the router's VPN server certificate, which the P2S CA issues."""
+    return bool(ctx['p2s_enabled'] and ctx['p2s_address_pool'] and ctx['local_fqdn'] and ctx['server_certificate'])
 
 
 def wg_ready(ctx):
@@ -640,7 +957,8 @@ def wg_ready(ctx):
 
 
 def openvpn_ready(ctx):
-    return bool(ctx['openvpn_enabled'] and ctx['openvpn_pool'] and ctx['local_fqdn'])
+    """OpenVPN needs its settings and the router's VPN server certificate, which the P2S CA issues."""
+    return bool(ctx['openvpn_enabled'] and ctx['openvpn_pool'] and ctx['local_fqdn'] and ctx['server_certificate'])
 
 
 def https_ready(ctx):
@@ -676,27 +994,38 @@ def render(env, ctx, template_name, dest, mode):
 
 
 def existing_peers(path):
-    """Return the [Peer] sections of an existing WireGuard config.
+    """The block of the users' peers and the [Peer] sections added by hand of an existing WireGuard config, each ''
+    without one.
 
-    Peers are added by the operator by hand, so re-rendering the [Interface]
-    section must not discard them.
+    The block lies between WG_PEERS_BEGIN and WG_PEERS_END; the [Peer] sections outside it are the operator's, which
+    re-rendering the file keeps.
     """
     path = pathlib.Path(path)
     if not path.is_file():
-        return ''
-    lines = path.read_text(encoding='utf-8').splitlines(keepends=True)
+        return '', ''
+    text = path.read_text(encoding='utf-8')
+    block = ''
+    begin, end = text.find(WG_PEERS_BEGIN), text.find(WG_PEERS_END)
+    if begin != -1 and end > begin:
+        block = text[begin:end + len(WG_PEERS_END)]
+        text = text[:begin] + text[end + len(WG_PEERS_END):]
+    lines = text.splitlines(keepends=True)
     for index, line in enumerate(lines):
         if line.strip().lower() == '[peer]':
-            return ''.join(lines[index:])
-    return ''
+            return block, ''.join(lines[index:])
+    return block, ''
 
 
 def render_wg_conf(env, ctx, dest=WG_CONF, mode=0o600):
-    """Render wg0.conf, carrying any operator-defined peers across."""
-    content = env.get_template('wg0.conf.j2').render(ctx)
-    peers = existing_peers(dest)
-    if peers:
-        content = content.rstrip('\n') + '\n\n' + peers
+    """Render wg0.conf: the [Interface], the block of the users' peers of ctx's wg_peers, the block the file holds while
+    wg_peers is None, and the peers the operator added by hand, carried across."""
+    content = env.get_template('wg0.conf.j2').render(ctx).rstrip('\n') + '\n'
+    block, own = existing_peers(dest)
+    if ctx['wg_peers'] is not None:
+        block = env.get_template('wg0-peers.conf.j2').render(ctx).strip('\n') if ctx['wg_peers'] else ''
+    for part in (block, own):
+        if part.strip():
+            content += '\n' + part.strip('\n') + '\n'
 
     dest = pathlib.Path(dest)
     if dest.exists() and dest.read_text(encoding='utf-8') == content:
@@ -731,62 +1060,6 @@ def install_file(src, dest, mode):
     return True
 
 
-def _simple_ca(*args):
-    result = subprocess.run(
-        [sys.executable, str(SIMPLE_CA), *args],
-        capture_output=True, text=True,
-    )
-    if result.returncode != 0:
-        fail(f'simple-ca {" ".join(args)} failed: {result.stderr.strip()}')
-    return result.stdout
-
-
-def provision_pki(ctx):
-    """Create the CA and CRL when the PKI directory is empty, and the server certificate once wan.local_fqdn is set.
-
-    A CA of the router's own (ca_key.pem present) without a CRL gets one, and without a
-    certificate for wan.local_fqdn gets one too; nothing present is overwritten.
-    """
-    PKI_DIR.mkdir(parents=True, exist_ok=True)
-    os.chmod(PKI_DIR, 0o700)
-    if not SIMPLE_CA.is_file():
-        fail(f'{SIMPLE_CA} is missing')
-
-    if not any(PKI_DIR.iterdir()):
-        if not ctx['p2s_ca_name']:
-            warn('p2s.ca_name is empty, not creating a local CA')
-            return
-        _simple_ca('make-ca', '--ca-dir', str(PKI_DIR), ctx['p2s_ca_name'])
-    if not (PKI_DIR / 'ca_key.pem').is_file():
-        return
-    if not (PKI_DIR / 'crl.pem').is_file():
-        _simple_ca('make-crl', '--ca-dir', str(PKI_DIR), '--days', str(CRL_DAYS))
-    label = ctx['local_fqdn'].split('.', 1)[0] if ctx['local_fqdn'] else ''
-    if label and not (PKI_DIR / f'{label}_cert.pem').is_file():
-        _simple_ca('make-cert', '--ca-dir', str(PKI_DIR), ctx['local_fqdn'], ctx['local_fqdn'])
-
-
-def distribute_pki(ctx):
-    """Copy PKI material to each consumer. Returns True when anything changed."""
-    label = ctx['local_fqdn'].split('.', 1)[0] if ctx['local_fqdn'] else ''
-    bundle = PKI_DIR / 'ca_bundle.pem'
-    ca_src = bundle if bundle.is_file() else PKI_DIR / 'ca_cert.pem'
-
-    changed = False
-    changed |= install_file(ca_src, CA_CERT_DEST, 0o644)
-    if label:
-        changed |= install_file(PKI_DIR / f'{label}_cert.pem', SERVER_CERT, 0o644)
-        changed |= install_file(PKI_DIR / f'{label}_key.pem', SERVER_KEY, 0o600)
-    changed |= install_file(PKI_DIR / 'crl.pem', CRL_DEST, 0o644)
-
-    if install_file(PKI_DIR / 'ca_cert.pem', TRUST_ANCHOR, 0o644):
-        changed = True
-        if shutil.which('update-ca-certificates'):
-            subprocess.run(['update-ca-certificates'],
-                           capture_output=True, text=True)
-    return changed
-
-
 def configure(cfg=None, public_ip=None):
     """Render configuration files and provision PKI.
 
@@ -809,9 +1082,30 @@ def configure(cfg=None, public_ip=None):
 
     changed = set()
 
-    provision_pki(ctx)
-    if distribute_pki(ctx):
-        changed.add('swanctl')
+    # Without the directory, which holds the PKI, the copies of the last run stay and what needs none is configured.
+    with vpnrouter_pki.locked():
+        try:
+            notices = vpnrouter_pki.provision(cfg, ctx)
+            if vpnrouter_pki.distribute(cfg):
+                changed.add('swanctl')
+        except vpnrouter_pki.Failure as failure:
+            fail(str(failure))
+        except ldap.LDAPError as exc:
+            notices = [f'the PKI is left as it is: the directory cannot be reached: {exc}']
+    for notice in notices:
+        warn(notice)
+    # The WireGuard peers of the users; None keeps those of wg0.conf while the directory cannot be reached.
+    ctx['wg_peers'] = None
+    if wg_ready(ctx):
+        try:
+            ctx['wg_peers'] = vpnrouter_ldap.wireguard_peers()
+        except ldap.LDAPError as exc:
+            warn(f'the WireGuard peers of the users are left as they are: the directory cannot be reached: {exc}')
+    # What needs the router's own certificates.
+    ctx['server_certificate'] = vpnrouter_pki.VPN_SERVER_CERT.is_file()
+    for connection in ctx['connections']:
+        if connection['auth'] == 'certificate':
+            connection['ready'] = connection['ready'] and vpnrouter_pki.S2S_CERT.is_file()
 
     env = _jinja_env()
 

debian-package/src/usr/lib/vpn-router/vpnrouter_backup.py

@@ -0,0 +1,412 @@
+"""The backups of the router, for vpn-router-backup and the web service.
+
+A backup is a consistent copy of the state that setup cannot make again, staged in STAGING: the
+trees of TREES, the files of site_to_site psk_file outside them under files/, the directory as
+slapcat writes it (ldap/vpn-router.ldif), with backup.metrics the database as pg_dump writes it
+(postgresql/vpn-router.dump), and manifest.json. The trees and the directory are copied while
+the configuration lock and the users lock are held, so the configuration, the PKI and the users
+match; pg_dump reads a snapshot of its own.
+
+backup.target local writes the staging directory as a tar archive compressed with zstd,
+ARCHIVE, to backup.path, removes the archives of this host that the retention settings of the
+schedule no longer keep, and with backup.rclone_remote syncs or copies the archives of this host
+to the remote of RCLONE_CONFIG. backup.target pbs sends the staging directory to a Proxmox Backup
+Server as the archive router.pxar of the snapshot host/<host>/<time>; the server keeps them.
+
+A run holds RUN_LOCK and records itself in STATE: result running, ok, warning (the backup is
+made, the cloud copy failed) or failed, with the times, the target, the archive or snapshot,
+its size, the error and the cloud copy. restore() puts a backup back and runs setup.
+"""
+
+import contextlib
+import datetime
+import fcntl
+import json
+import os
+import pathlib
+import re
+import shutil
+import socket
+import subprocess
+import tempfile
+import time
+
+import vpnrouter
+import vpnrouter_auth
+import vpnrouter_ldap
+import vpnrouter_users
+
+STATE = pathlib.Path('/var/lib/vpn-router/backup.json')
+WORK_DIR = pathlib.Path('/var/lib/vpn-router/backup')
+STAGING = WORK_DIR / 'staging'
+RESTORE_DIR = WORK_DIR / 'restore'
+#: What a restore replaces is kept here, in a directory named after the time of the restore.
+BEFORE_RESTORE = WORK_DIR / 'before-restore'
+RUN_LOCK = pathlib.Path('/run/vpn-router/backup.lock')
+RCLONE_CONFIG = pathlib.Path('/etc/vpn-router/rclone.conf')
+PBS_CLIENT = pathlib.Path('/usr/bin/proxmox-backup-client')
+UNIT = 'vpn-router-backup.service'
+TIMER = 'vpn-router-backup.timer'
+
+#: The state a backup copies: directories and files, each where it is on the system.
+TREES = ('/etc/vpn-router', '/etc/wireguard', '/etc/ufw', '/etc/default/ufw', '/etc/vpn-router-manager')
+
+#: The name of a local archive: the host and the UTC time of the backup.
+ARCHIVE = re.compile(r'^vpn-router-(?P<host>[A-Za-z0-9][A-Za-z0-9.-]*)-(?P<stamp>\d{8}T\d{6}Z)\.tar\.zst$')
+STAMP = '%Y%m%dT%H%M%SZ'
+
+LDIF = 'ldap/vpn-router.ldif'
+DUMP = 'postgresql/vpn-router.dump'
+PBS_ARCHIVE = 'router.pxar'
+
+#: The period of each retention setting, as strftime formats of local time; weeks are ISO weeks.
+PERIODS = {'keep_hourly': '%Y-%m-%d %H', 'keep_daily': '%Y-%m-%d', 'keep_weekly': '%G-%V', 'keep_monthly': '%Y-%m',
+           'keep_yearly': '%Y'}
+
+#: The units a restore stops while it replaces the directory and the database, and the ones it restarts after setup.
+RESTORE_STOPS = ('vpn-router-web.service', 'vpn-router-metrics.service', 'slapd.service')
+RESTORE_RESTARTS = ('wg-quick@wg0.service', 'openvpn-server@vpn-router.service', 'strongswan.service',
+                    'vpn-router-manager.service')
+
+
+class Failure(Exception):
+    """A backup or a restore that cannot be done."""
+
+
+def now():
+    """The local time in ISO 8601, to the second, with its offset."""
+    return datetime.datetime.now().astimezone().isoformat(timespec='seconds')
+
+
+def host():
+    """The name of this host, which names its archives and its PBS backup group."""
+    return socket.gethostname().split('.')[0]
+
+
+def command(args, **kwargs):
+    """Run a command; Failure with its standard error when it fails."""
+    try:
+        result = subprocess.run(args, capture_output=True, text=True, **kwargs)
+    except OSError as exc:
+        raise Failure(f'{args[0]}: {exc.strerror}')
+    if result.returncode != 0:
+        raise Failure(f'{" ".join(args[:2])} failed: {result.stderr.strip() or result.stdout.strip()}')
+    return result.stdout
+
+
+def write_state(state):
+    """Write STATE in one step."""
+    STATE.parent.mkdir(parents=True, exist_ok=True)
+    descriptor, name = tempfile.mkstemp(dir=STATE.parent, prefix='.backup.json.')
+    with os.fdopen(descriptor, 'w', encoding='utf-8') as handle:
+        handle.write(json.dumps(state, indent=2) + '\n')
+    os.chmod(name, 0o600)
+    os.replace(name, STATE)
+
+
+def running():
+    """Whether a run holds RUN_LOCK."""
+    try:
+        with open(RUN_LOCK, encoding='utf-8') as handle:
+            fcntl.flock(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
+    except FileNotFoundError:
+        return False
+    except BlockingIOError:
+        return True
+    return False
+
+
+def state():
+    """The state of the last run, {} when there was none; a run that ended without recording it is interrupted."""
+    try:
+        recorded = json.loads(STATE.read_text(encoding='utf-8'))
+    except (OSError, ValueError):
+        return {}
+    if recorded.get('result') == 'running' and not running():
+        recorded['result'] = 'interrupted'
+    return recorded
+
+
+@contextlib.contextmanager
+def run_lock():
+    """Hold RUN_LOCK; Failure when another run holds it."""
+    RUN_LOCK.parent.mkdir(parents=True, exist_ok=True)
+    with open(RUN_LOCK, 'a', encoding='utf-8') as handle:
+        try:
+            fcntl.flock(handle, fcntl.LOCK_EX | fcntl.LOCK_NB)
+        except BlockingIOError:
+            raise Failure('another backup or restore is running')
+        yield
+
+
+def archives(path):
+    """The archives of this host in path, newest first, as [{name, time, size}]; time is the UTC time of the backup."""
+    found = []
+    try:
+        entries = list(os.scandir(path))
+    except OSError:
+        return found
+    for entry in entries:
+        match = ARCHIVE.match(entry.name)
+        if match and match['host'] == host() and entry.is_file():
+            when = datetime.datetime.strptime(match['stamp'], STAMP).replace(tzinfo=datetime.timezone.utc)
+            found.append({'name': entry.name, 'time': when.isoformat(), 'size': entry.stat().st_size})
+    return sorted(found, key=lambda item: item['time'], reverse=True)
+
+
+def kept(found, keeps):
+    """The names of the archives the retention settings keep, by the rules of Proxmox Backup Server's prune.
+
+    found is newest first. The settings apply in the order of PERIODS: each keeps the newest archive of each of its
+    last N periods that have archives and no archive a former setting kept, and the older archives of those periods
+    are removed, so no later setting keeps them.
+    """
+    marks = {}
+    for option, period in PERIODS.items():
+        count = keeps.get(option, 0)
+        if not count:
+            continue
+        periods = {moment(item).strftime(period) for item in found if marks.get(item['name']) == 'keep'}
+        included = set()
+        for item in found:
+            if item['name'] in marks:
+                continue
+            key = moment(item).strftime(period)
+            if key in periods:
+                continue
+            if key not in included:
+                if len(included) >= count:
+                    break
+                included.add(key)
+                marks[item['name']] = 'keep'
+            else:
+                marks[item['name']] = 'remove'
+    return {name for name, mark in marks.items() if mark == 'keep'}
+
+
+def moment(item):
+    """The local time of an archive of archives()."""
+    return datetime.datetime.fromisoformat(item['time']).astimezone()
+
+
+def psk_files(cfg):
+    """The psk_file of each site_to_site connection outside the trees of TREES."""
+    files = []
+    for connection in cfg['site_to_site'].values():
+        name = connection['psk_file'].strip()
+        if name and not any(name == tree or name.startswith(tree + '/') for tree in TREES) and os.path.isfile(name):
+            files.append(name)
+    return files
+
+
+def database_args(cfg):
+    """The command prefix and the database argument of pg_dump and pg_restore: postgres and vpn-router, or web.database."""
+    configured = cfg['web']['database'].strip()
+    if configured:
+        return [], [f'--dbname={configured}']
+    return ['runuser', '-u', 'postgres', '--'], [f'--dbname={vpnrouter_auth.DATABASE}']
+
+
+def stage(cfg):
+    """Copy what a backup holds to STAGING, emptied first, and return the manifest."""
+    shutil.rmtree(STAGING, ignore_errors=True)
+    STAGING.mkdir(parents=True, mode=0o700)
+    trees = [tree for tree in TREES if os.path.exists(tree)]
+    files = psk_files(cfg)
+    vpnrouter_users.LOCK_FILE.parent.mkdir(parents=True, exist_ok=True)
+    with vpnrouter.config_lock(), open(vpnrouter_users.LOCK_FILE, 'w') as users:
+        fcntl.flock(users, fcntl.LOCK_EX)
+        command(['cp', '-a', '--parents', *trees, str(STAGING)])
+        if files:
+            (STAGING / 'files').mkdir()
+            command(['cp', '-a', '--parents', *files, str(STAGING / 'files')])
+        (STAGING / LDIF).parent.mkdir()
+        command(['slapcat', '-b', vpnrouter_ldap.BASE, '-l', str(STAGING / LDIF)])
+    items = trees + [f'files{name}' for name in files] + [LDIF]
+    if cfg['backup']['metrics']:
+        (STAGING / DUMP).parent.mkdir()
+        prefix, database = database_args(cfg)
+        with open(STAGING / DUMP, 'wb') as dump:
+            result = subprocess.run([*prefix, 'pg_dump', '-Fc', *database], stdout=dump, stderr=subprocess.PIPE)
+        if result.returncode != 0:
+            raise Failure(f'pg_dump failed: {result.stderr.decode(errors="replace").strip()}')
+        items.append(DUMP)
+    version = subprocess.run(['dpkg-query', '-W', '-f=${Version}', 'vpn-router'], capture_output=True, text=True)
+    manifest = {'host': host(), 'time': now(), 'version': version.stdout.strip() or None,
+                'schedule': cfg['backup']['schedule'], 'items': items}
+    (STAGING / 'manifest.json').write_text(json.dumps(manifest, indent=2) + '\n', encoding='utf-8')
+    return manifest
+
+
+def pbs_environment(cfg):
+    """The environment of proxmox-backup-client: the repository, the token secret and the fingerprint of backup."""
+    if not PBS_CLIENT.exists():
+        raise Failure(f'{PBS_CLIENT} does not exist; install proxmox-backup-client-static')
+    backup = cfg['backup']
+    environment = dict(os.environ, PBS_REPOSITORY=backup['pbs_repository'], PBS_PASSWORD=backup['pbs_password'])
+    if backup['pbs_fingerprint']:
+        environment['PBS_FINGERPRINT'] = backup['pbs_fingerprint']
+    return environment
+
+
+def pbs_options(cfg):
+    """The namespace and key file options of proxmox-backup-client from backup."""
+    options = []
+    if cfg['backup']['pbs_namespace']:
+        options += ['--ns', cfg['backup']['pbs_namespace']]
+    if cfg['backup']['pbs_keyfile']:
+        options += ['--keyfile', cfg['backup']['pbs_keyfile']]
+    return options
+
+
+def cloud(cfg):
+    """Sync or copy the archives of this host in backup.path to backup.rclone_remote; Failure when it fails."""
+    backup = cfg['backup']
+    rclone = shutil.which('rclone')
+    if not rclone:
+        raise Failure('rclone is not installed')
+    if not RCLONE_CONFIG.is_file():
+        raise Failure(f'{RCLONE_CONFIG} does not exist; make the remote with rclone config --config {RCLONE_CONFIG}')
+    command([rclone, backup['rclone_mode'], backup['path'], backup['rclone_remote'], '--config', str(RCLONE_CONFIG),
+             '--include', f'vpn-router-{host()}-*.tar.zst'])
+
+
+def run():
+    """Make a backup to backup.target as the configuration says, recording it in STATE; the recorded state."""
+    cfg = vpnrouter.load_config()
+    backup = cfg['backup']
+    started = time.time()
+    record = {'result': 'running', 'started': now(), 'finished': None, 'target': backup['target'], 'archive': None,
+              'snapshot': None, 'size': None, 'removed': [], 'error': None, 'cloud': None}
+    with run_lock():
+        write_state(record)
+        try:
+            stage(cfg)
+            if backup['target'] == 'pbs':
+                epoch = int(started)
+                command([str(PBS_CLIENT), 'backup', f'{PBS_ARCHIVE}:{STAGING}', '--backup-type', 'host',
+                         '--backup-id', host(), '--backup-time', str(epoch), *pbs_options(cfg)],
+                        env=pbs_environment(cfg))
+                stamp = datetime.datetime.fromtimestamp(epoch, datetime.timezone.utc).strftime('%Y-%m-%dT%H:%M:%SZ')
+                record['snapshot'] = f'host/{host()}/{stamp}'
+                record['size'] = sum(path.stat().st_size for path in STAGING.rglob('*') if path.is_file())
+            else:
+                path = pathlib.Path(backup['path'])
+                path.mkdir(parents=True, mode=0o700, exist_ok=True)
+                name = f'vpn-router-{host()}-{time.strftime(STAMP, time.gmtime(started))}.tar.zst'
+                partial = path / f'{name}.partial'
+                command(['tar', '--zstd', '-cf', str(partial), '-C', str(STAGING), '.'])
+                partial.chmod(0o600)
+                partial.rename(path / name)
+                record['archive'] = name
+                record['size'] = (path / name).stat().st_size
+                found = archives(path)
+                keep = kept(found, {option: backup[option] for option in vpnrouter.backup_keeps(backup['schedule'])})
+                for item in found:
+                    if item['name'] not in keep:
+                        (path / item['name']).unlink()
+                        record['removed'].append(item['name'])
+                if backup['rclone_remote']:
+                    record['cloud'] = {'remote': backup['rclone_remote'], 'mode': backup['rclone_mode'],
+                                       'result': 'ok', 'error': None}
+                    try:
+                        cloud(cfg)
+                    except Failure as exc:
+                        record['cloud'].update(result='failed', error=str(exc))
+            record['result'] = 'warning' if record['cloud'] and record['cloud']['result'] != 'ok' else 'ok'
+        except (Failure, OSError) as exc:
+            record['result'] = 'failed'
+            record['error'] = str(exc)
+        finally:
+            shutil.rmtree(STAGING, ignore_errors=True)
+            record['finished'] = now()
+            write_state(record)
+    return record
+
+
+def snapshots(cfg):
+    """The PBS snapshots of this host, as proxmox-backup-client lists them."""
+    namespace = cfg['backup']['pbs_namespace']
+    return command([str(PBS_CLIENT), 'snapshot', 'list', f'host/{host()}', *(['--ns', namespace] if namespace else [])],
+                   env=pbs_environment(cfg))
+
+
+def extract(cfg, source, pbs):
+    """Unpack a local archive, or with pbs fetch a snapshot, to RESTORE_DIR, emptied first; the manifest."""
+    shutil.rmtree(RESTORE_DIR, ignore_errors=True)
+    RESTORE_DIR.mkdir(parents=True, mode=0o700)
+    if pbs:
+        command([str(PBS_CLIENT), 'restore', source, PBS_ARCHIVE, str(RESTORE_DIR), *pbs_options(cfg)],
+                env=pbs_environment(cfg))
+    else:
+        command(['tar', '--zstd', '-xf', source, '-C', str(RESTORE_DIR)])
+    try:
+        return json.loads((RESTORE_DIR / 'manifest.json').read_text(encoding='utf-8'))
+    except (OSError, ValueError):
+        raise Failure(f'{source} is not a backup of vpn-router-backup: it has no manifest.json')
+
+
+def put_back(relative, target, saved):
+    """Move target to saved, keeping its path, and copy the staged relative path of RESTORE_DIR in its place."""
+    target = pathlib.Path(target)
+    if target.exists() or target.is_symlink():
+        keep = saved / target.relative_to('/')
+        keep.parent.mkdir(parents=True, exist_ok=True)
+        shutil.move(target, keep)
+    target.parent.mkdir(parents=True, exist_ok=True)
+    command(['cp', '-a', str(RESTORE_DIR / relative), str(target)])
+
+
+def restore(source, pbs, confirm):
+    """Put the backup back: a local archive, or with pbs a snapshot; confirm(manifest) is asked before any change.
+
+    What is replaced is kept in BEFORE_RESTORE. The services of the directory and the database are stopped while they
+    are replaced, and setup applies the configuration afterwards. Returns the directory of what was replaced, or None
+    when confirm declined.
+    """
+    cfg = vpnrouter.load_config()
+    with run_lock():
+        try:
+            manifest = extract(cfg, source, pbs)
+            if not confirm(manifest):
+                return None
+            saved = BEFORE_RESTORE / time.strftime(STAMP, time.gmtime())
+            saved.mkdir(parents=True, mode=0o700)
+            for unit in RESTORE_STOPS:
+                subprocess.run(['systemctl', 'stop', unit], capture_output=True)
+            for item in manifest['items']:
+                if item.startswith('/'):
+                    put_back(item.lstrip('/'), item, saved)
+                elif item.startswith('files/'):
+                    put_back(item, item[len('files'):], saved)
+            if LDIF in manifest['items']:
+                directory = vpnrouter_ldap.DB_DIRECTORY
+                if directory.exists():
+                    shutil.move(directory, saved / 'ldap')
+                directory.mkdir(mode=0o700)
+                command(['slapadd', '-b', vpnrouter_ldap.BASE, '-l', str(RESTORE_DIR / LDIF)])
+                command(['chown', '-R', 'openldap:openldap', str(directory)])
+            subprocess.run(['systemctl', 'start', 'slapd.service'], capture_output=True)
+            restored = vpnrouter.load_config()
+            if not restored['web']['database'].strip():
+                secret = vpnrouter_auth.DATABASE_SECRET
+                if secret.is_file() and vpnrouter_auth.psql("SELECT 1 FROM pg_roles WHERE rolname = :'v1'",
+                                                            vpnrouter_auth.DATABASE):
+                    password = secret.read_text(encoding='utf-8').strip()
+                    vpnrouter_auth.psql(f"ALTER ROLE :\"v1\" PASSWORD '{password}'", vpnrouter_auth.DATABASE)
+                vpnrouter_auth.provision(restored)
+            if DUMP in manifest['items']:
+                prefix, database = database_args(restored)
+                with open(RESTORE_DIR / DUMP, 'rb') as dump:
+                    result = subprocess.run([*prefix, 'pg_restore', '--clean', '--if-exists', *database], stdin=dump,
+                                            stdout=subprocess.DEVNULL, stderr=subprocess.PIPE)
+                if result.returncode != 0:
+                    raise Failure(f'pg_restore failed: {result.stderr.decode(errors="replace").strip()}')
+            subprocess.run(['systemctl', 'start', 'vpn-router-web.service'], capture_output=True)
+            command(['systemctl', 'restart', 'vpn-router-setup.service'])
+            for unit in RESTORE_RESTARTS:
+                subprocess.run(['systemctl', 'try-restart', unit], capture_output=True)
+            subprocess.run(['ufw', 'reload'], capture_output=True)
+            return saved
+        finally:
+            shutil.rmtree(RESTORE_DIR, ignore_errors=True)

debian-package/src/usr/lib/vpn-router/vpnrouter_ldap.py

@@ -11,6 +11,13 @@ The password policy locks an account for LOCKOUT_SECONDS after LOCKOUT_FAILURES
 a successful bind clears the count. slapd's otp overlay is configured on the database, so a
 bind of a user with a TOTP token takes the password followed by a current code.
 cn=totp,ou=policies holds the TOTP parameters the token of every user points to.
+
+A user with console login on its own account is also a posixAccount, with a uidNumber from
+CONSOLE_UID_MIN and the gidNumber of the local group CONSOLE_GROUP; nslcd serves those with
+vpnRouterConsoleLogin TRUE to the system over the local socket.
+
+ou=pki holds the router's PKI (vpnrouter_pki): an entry per CA, and under it an entry per
+certificate the CA issued. Private keys are readable by root alone, the database's root DN.
 """
 
 import os
@@ -24,11 +31,14 @@ import ldap.modlist
 import ldap.sasl
 
 URI = 'ldapi:///'
+#: The local socket ldapi:/// names, which slapd listens on.
+SLAPD_SOCKET = '/var/run/slapd/ldapi'
 BASE = 'dc=vpn-router,dc=local'
 USERS = f'ou=users,{BASE}'
 GROUPS = f'ou=groups,{BASE}'
 SERVICES = f'ou=services,{BASE}'
 POLICIES = f'ou=policies,{BASE}'
+PKI = f'ou=pki,{BASE}'
 DEFAULT_POLICY = f'cn=default,{POLICIES}'
 TOTP_PARAMS = f'cn=totp,{POLICIES}'
 MANAGER = f'cn=user-manager,{SERVICES}'
@@ -52,17 +62,55 @@ OVERLAYS = ('ppolicy', 'otp')
 
 #: The package's own schema, under an OID of the UUID arc 2.25 (ITU-T X.667): attribute types
 #: under .1 and object classes under .2. vpnRouterAccount, auxiliary, adds properties of the
-#: package to a user of either kind: mail, for a Manager-only account, and vpnRouterScope,
-#: authorization scopes, of which service marks a service account.
+#: package to a user of either kind: mail, for a Manager-only account, vpnRouterScope,
+#: authorization scopes, of which service marks a service account, displayName and
+#: description, the labels of a service account, and vpnRouterConsoleLogin and
+#: vpnRouterConsoleAccount, whether the user may use a console and the local account it runs as,
+#: without which it runs as the user's own posixAccount, and vpnRouterWireGuardPeer, each a
+#: WireGuard peer of the user as "<public key> <IP>[,<IP>...]". vpnRouterAuthority is a CA of the PKI: its
+#: certificate and CRL (cACertificate and certificateRevocationList of RFC 4523), its key, the
+#: CSR it waits with for the offline root, the number of its last CRL, where the CRL came from,
+#: and when it was retired. vpnRouterCertificate is a certificate a CA issued, named by its
+#: serial number: the certificate, the key the router keeps for its own and the users'
+#: certificates, its kind, template, names and expiry, and its revocation.
 SCHEMA_OID = '2.25.98477352595735834532404256531620013001'
 SCHEMA_NAME = 'vpn-router'
+_STRING = 'EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} SINGLE-VALUE'
+_TIME = 'EQUALITY generalizedTimeMatch ORDERING generalizedTimeOrderingMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.24 SINGLE-VALUE'
+_OCTETS = 'EQUALITY octetStringMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.40 SINGLE-VALUE'
 SCHEMA_ATTRIBUTE_TYPES = (
     f"( {SCHEMA_OID}.1.1 NAME 'vpnRouterScope' DESC 'VPN router: an authorization scope of the account' "
     "EQUALITY caseIgnoreMatch SUBSTR caseIgnoreSubstringsMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )",
+    f"( {SCHEMA_OID}.1.2 NAME 'vpnRouterPrivateKey' DESC 'VPN router: a private key, PEM' {_OCTETS} )",
+    f"( {SCHEMA_OID}.1.3 NAME 'vpnRouterCertificateRequest' DESC 'VPN router: the CSR of a CA, PEM' {_OCTETS} )",
+    f"( {SCHEMA_OID}.1.4 NAME 'vpnRouterCRLNumber' DESC 'VPN router: the number of the last CRL of a CA' "
+    "EQUALITY integerMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.27 SINGLE-VALUE )",
+    f"( {SCHEMA_OID}.1.5 NAME 'vpnRouterCRLSource' DESC 'VPN router: signed or uploaded, where the CRL of a CA came from' {_STRING} )",
+    f"( {SCHEMA_OID}.1.6 NAME 'vpnRouterRetired' DESC 'VPN router: when a CA was retired' {_TIME} )",
+    f"( {SCHEMA_OID}.1.7 NAME 'vpnRouterKind' DESC 'VPN router: ca, router, user or external, the kind of a certificate' {_STRING} )",
+    f"( {SCHEMA_OID}.1.8 NAME 'vpnRouterTemplate' DESC 'VPN router: the template of a certificate' {_STRING} )",
+    f"( {SCHEMA_OID}.1.9 NAME 'vpnRouterSubjectAltName' DESC 'VPN router: a subject alternative name of a certificate' "
+    "EQUALITY caseIgnoreMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{256} )",
+    f"( {SCHEMA_OID}.1.10 NAME 'vpnRouterNotAfter' DESC 'VPN router: when a certificate expires' {_TIME} )",
+    f"( {SCHEMA_OID}.1.11 NAME 'vpnRouterRevoked' DESC 'VPN router: when a certificate was revoked' {_TIME} )",
+    f"( {SCHEMA_OID}.1.12 NAME 'vpnRouterRevocationReason' DESC 'VPN router: why a certificate was revoked' {_STRING} )",
+    f"( {SCHEMA_OID}.1.13 NAME 'vpnRouterConsoleLogin' DESC 'VPN router: whether the user may use a console' "
+    "EQUALITY booleanMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.7 SINGLE-VALUE )",
+    f"( {SCHEMA_OID}.1.14 NAME 'vpnRouterConsoleAccount' DESC 'VPN router: the local account the console of the user runs as' "
+    f"{_STRING} )",
+    f"( {SCHEMA_OID}.1.15 NAME 'vpnRouterWireGuardPeer' DESC 'VPN router: a WireGuard peer of the user, its public key and IPs' "
+    "EQUALITY caseExactMatch SYNTAX 1.3.6.1.4.1.1466.115.121.1.15{1024} )",
 )
 SCHEMA_OBJECT_CLASSES = (
     f"( {SCHEMA_OID}.2.1 NAME 'vpnRouterAccount' DESC 'VPN router: properties of a user or a Manager-only account' "
-    "SUP top AUXILIARY MAY ( mail $ vpnRouterScope ) )",
+    "SUP top AUXILIARY MAY ( mail $ vpnRouterScope $ displayName $ description $ vpnRouterConsoleLogin $ "
+    "vpnRouterConsoleAccount $ vpnRouterWireGuardPeer ) )",
+    f"( {SCHEMA_OID}.2.2 NAME 'vpnRouterAuthority' DESC 'VPN router: a CA of the PKI' SUP top STRUCTURAL MUST cn "
+    "MAY ( cACertificate $ certificateRevocationList $ vpnRouterPrivateKey $ vpnRouterCertificateRequest $ "
+    "vpnRouterCRLNumber $ vpnRouterCRLSource $ vpnRouterRetired ) )",
+    f"( {SCHEMA_OID}.2.3 NAME 'vpnRouterCertificate' DESC 'VPN router: a certificate a CA of the PKI issued' SUP top "
+    "STRUCTURAL MUST serialNumber MAY ( cn $ userCertificate $ vpnRouterPrivateKey $ vpnRouterKind $ vpnRouterTemplate $ "
+    "vpnRouterSubjectAltName $ vpnRouterNotAfter $ vpnRouterRevoked $ vpnRouterRevocationReason ) )",
 )
 
 #: The TOTP parameters: digits, the OID of HMAC-SHA1, seconds per time step, and the time steps accepted before and after now.
@@ -71,8 +119,22 @@ TOTP_ALGORITHM = '1.2.840.113549.2.7'
 TOTP_PERIOD = 30
 TOTP_WINDOW = 1
 
+#: The value of pwdAccountLockedTime that disables a user until it is enabled again.
+DISABLED = '000001010000Z'
+
+#: The indexes of the database.
+INDEXES = ('objectClass eq', 'uid eq', 'uidNumber eq', 'vpnRouterConsoleLogin eq')
+
+#: The POSIX accounts of console login (vpnrouter_users.console): the lowest uidNumber, which nslcd's nss_min_uid
+#: matches, the local group that is their primary group and grants sudo, the shell and the parent of their homes.
+CONSOLE_UID_MIN = 20000
+CONSOLE_GROUP = 'vpn-router-console'
+CONSOLE_SHELL = '/bin/bash'
+CONSOLE_HOMES = '/home'
+
 #: The ACLs of the database, in order.
 ACCESS = (
+    'to attrs=vpnRouterPrivateKey by * none',
     f'to attrs=userPassword by dn.exact="{MANAGER}" =wx by self =wx by anonymous auth by * none',
     f'to attrs=oathSecret by dn.exact="{MANAGER}" =w by * none',
     f'to dn.subtree="{USERS}" by dn.exact="{MANAGER}" manage by * read',
@@ -125,20 +187,27 @@ def _ensure_modules(connection):
 
 
 def _ensure_schema(connection):
-    """Add the package's schema to cn=config when missing, else set its definitions that differ."""
+    """Add the package's schema to cn=config when missing, else add the definitions it lacks; a definition that differs
+    from the one of the same OID replaces the whole list of its kind."""
     found = connection.search_s('cn=schema,cn=config', ldap.SCOPE_ONELEVEL, f'(cn=*{SCHEMA_NAME})',
                                 ['olcAttributeTypes', 'olcObjectClasses'])
-    attributes = {'olcAttributeTypes': [value.encode() for value in SCHEMA_ATTRIBUTE_TYPES],
-                  'olcObjectClasses': [value.encode() for value in SCHEMA_OBJECT_CLASSES]}
+    attributes = {'olcAttributeTypes': list(SCHEMA_ATTRIBUTE_TYPES), 'olcObjectClasses': list(SCHEMA_OBJECT_CLASSES)}
     if not found:
         connection.add_s(f'cn={SCHEMA_NAME},cn=schema,cn=config', ldap.modlist.addModlist(
-            dict(attributes, objectClass=[b'olcSchemaConfig'], cn=[SCHEMA_NAME.encode()])))
+            dict({name: [value.encode() for value in values] for name, values in attributes.items()},
+                 objectClass=[b'olcSchemaConfig'], cn=[SCHEMA_NAME.encode()])))
         return
     dn, current = found[0]
-    changes = [(ldap.MOD_REPLACE, name, values) for name, values in attributes.items()
-               if unordered(current.get(name, [])) != [value.decode() for value in values]]
-    if changes:
-        connection.modify_s(dn, changes)
+    for name, wanted in attributes.items():
+        present = unordered(current.get(name, []))
+        oids = {value.split()[1] for value in present}
+        missing = [value for value in wanted if value not in present]
+        if not missing:
+            continue
+        if any(value.split()[1] in oids for value in missing):
+            connection.modify_s(dn, [(ldap.MOD_REPLACE, name, [value.encode() for value in wanted])])
+        else:
+            connection.modify_s(dn, [(ldap.MOD_ADD, name, [value.encode() for value in missing])])
 
 
 def _ensure_password_hash(connection):
@@ -149,8 +218,9 @@ def _ensure_password_hash(connection):
 
 
 def _ensure_database(connection):
-    """The DN of the package's database in cn=config, created when missing; its ACLs are kept as ACCESS."""
-    found = connection.search_s('cn=config', ldap.SCOPE_ONELEVEL, f'(olcSuffix={BASE})', ['olcAccess'])
+    """The DN of the package's database in cn=config, created when missing; its ACLs are kept as ACCESS, and the
+    indexes of INDEXES it lacks are added, which slapd builds online."""
+    found = connection.search_s('cn=config', ldap.SCOPE_ONELEVEL, f'(olcSuffix={BASE})', ['olcAccess', 'olcDbIndex'])
     if not found:
         DB_DIRECTORY.mkdir(mode=0o700, parents=True, exist_ok=True)
         openldap = pwd.getpwnam('openldap')
@@ -161,13 +231,17 @@ def _ensure_database(connection):
             'olcSuffix': [BASE.encode()],
             'olcDbDirectory': [str(DB_DIRECTORY).encode()],
             'olcRootDN': [ROOT.encode()],
-            'olcDbIndex': [b'objectClass eq', b'uid eq'],
+            'olcDbIndex': [index.encode() for index in INDEXES],
             'olcAccess': [f'{{{index}}}{rule}'.encode() for index, rule in enumerate(ACCESS)],
         }))
-        found = connection.search_s('cn=config', ldap.SCOPE_ONELEVEL, f'(olcSuffix={BASE})', ['olcAccess'])
+        found = connection.search_s('cn=config', ldap.SCOPE_ONELEVEL, f'(olcSuffix={BASE})', ['olcAccess', 'olcDbIndex'])
     dn, attributes = found[0]
     if unordered(attributes.get('olcAccess', [])) != list(ACCESS):
         connection.modify_s(dn, [(ldap.MOD_REPLACE, 'olcAccess', [f'{{{index}}}{rule}'.encode() for index, rule in enumerate(ACCESS)])])
+    present = [value.decode() for value in attributes.get('olcDbIndex', [])]
+    missing = [index for index in INDEXES if index not in present]
+    if missing:
+        connection.modify_s(dn, [(ldap.MOD_ADD, 'olcDbIndex', [index.encode() for index in missing])])
     return dn
 
 
@@ -219,6 +293,23 @@ def _ensure_manager(connection):
         MANAGER_SECRET.write_text(password, encoding='utf-8')
 
 
+def wireguard_peers():
+    """The WireGuard peers of the users who are not disabled, read as root: [(user, public key, [IP, ...])], sorted."""
+    connection = root()
+    try:
+        found = connection.search_s(USERS, ldap.SCOPE_ONELEVEL,
+                                    f'(&(vpnRouterWireGuardPeer=*)(!(pwdAccountLockedTime={DISABLED})))',
+                                    ['uid', 'vpnRouterWireGuardPeer'])
+    finally:
+        connection.unbind_s()
+    peers = []
+    for _, attributes in found:
+        for value in attributes['vpnRouterWireGuardPeer']:
+            key, _, ips = value.decode().partition(' ')
+            peers.append((attributes['uid'][0].decode(), key, ips.split(',')))
+    return sorted(peers)
+
+
 def provision():
     """Create or bring up to date the modules, the package's schema, database, ACLs, password policy, entries and service account."""
     connection = root()
@@ -229,7 +320,7 @@ def provision():
         database = _ensure_database(connection)
         _ensure_overlays(connection, database)
         _ensure_entry(connection, BASE, {'objectClass': [b'dcObject', b'organization'], 'dc': [b'vpn-router'], 'o': [b'vpn-router']})
-        for unit in (USERS, GROUPS, SERVICES, POLICIES):
+        for unit in (USERS, GROUPS, SERVICES, POLICIES, PKI):
             _ensure_entry(connection, unit, {'objectClass': [b'organizationalUnit'], 'ou': [unit.split(',')[0][3:].encode()]})
         _ensure_entry(connection, DEFAULT_POLICY, {
             'objectClass': [b'organizationalRole', b'pwdPolicy'],

debian-package/src/usr/lib/vpn-router/vpnrouter_metrics.py

@@ -44,6 +44,15 @@ LEVELS = (
 #: The kinds of VPN clients of metrics_vpn.
 VPN_KINDS = ('p2s', 'openvpn', 'wireguard')
 
+#: The time slots of the site-to-site availability of each view of history(): the summary level read (None: the
+#: details), the slot as PostgreSQL starts it from time, and its length.
+UP_SLOTS = {
+    'hour': (None, "date_bin('5 minutes', time, timestamptz '2000-01-01 00:00:00+00')", '5 minutes'),
+    'day': (None, "date_trunc('hour', time, 'UTC')", '1 hour'),
+    'month': ('hourly', "date_trunc('day', time, 'UTC')", '1 day'),
+    'year': ('monthly', "date_trunc('month', time, 'UTC')", '1 month'),
+}
+
 #: The views of history(): the summary level read (None: the details), the bucket and the span.
 RANGES = {
     'hour': (None, '1 minute', '1 hour'),
@@ -148,8 +157,13 @@ def history(connection, view):
     each interface to its rx and tx, clients, which maps each kind of VPN client to its clients,
     and site_to_site, which maps each site-to-site connection to the values of
     metrics_site_to_site; a value without data is None.
+
+    site_to_site_up is the availability of each site-to-site connection in the time slots of UP_SLOTS, oldest first:
+    for each slot its start in Unix seconds and, per connection, the percentage of its samples in which the connection
+    was up, 0 to 100; the summaries' averages of up give it for the month and the year.
     """
     level, bucket, span = RANGES[view]
+    up_level, up_start, up_slot = UP_SLOTS[view]
 
     def rows(table):
         keys, values = TABLES[table]
@@ -182,4 +196,12 @@ def history(connection, view):
     for row in rows('metrics_site_to_site'):
         point(row[0])['site_to_site'][row[1]] = pairs(row[2:], TABLES['metrics_site_to_site'][1])
     empty = {value: {'avg': None, 'max': None} for value in TABLES['metrics_system'][1]}
-    return {'range': view, 'bucket': bucket, 'points': [{**empty, **points[start]} for start in sorted(points)]}
+
+    slots = {}
+    for start, name, percent in connection.execute(
+            f"SELECT extract(epoch FROM {up_start})::bigint AS slot, connection, avg({'up' if up_level is None else 'up_avg'}) * 100 "
+            f"FROM {'metrics_site_to_site' if up_level is None else f'metrics_site_to_site_{up_level}'} "
+            f"WHERE time >= now() - interval '{span}' GROUP BY slot, connection ORDER BY slot").fetchall():
+        slots.setdefault(start, {'time': start, 'connections': {}})['connections'][name] = percent
+    return {'range': view, 'bucket': bucket, 'points': [{**empty, **points[start]} for start in sorted(points)],
+            'site_to_site_up': {'slot': up_slot, 'points': [slots[start] for start in sorted(slots)]}}

debian-package/src/usr/lib/vpn-router/vpnrouter_status.py

@@ -12,6 +12,9 @@ COMMAND_TIMEOUT = 5
 
 OPENVPN_STATUS = '/run/openvpn-server/status-vpn-router.log'
 
+#: Seconds between two writes of OPENVPN_STATUS by the OpenVPN server, whose configuration sets it (OpenVPN's default is 60).
+OPENVPN_STATUS_SECONDS = 5
+
 #: Seconds since its last handshake within which a WireGuard peer counts as connected.
 WIREGUARD_CONNECTED_SECONDS = 180
 

debian-package/src/usr/lib/vpn-router/vpnrouter_users.py

@@ -2,15 +2,17 @@
 
 A user is an entry in ou=users of the router's directory, of one of two kinds, fixed when it is
 added. A VPN user is an inetOrgPerson with a first name, a last name and an e-mail address, whose
-password OpenVPN checks, and a client certificate of the router CA with the user name as its
-common name, which OpenVPN and IKEv2 accept. A Manager-only account is an account,
+password OpenVPN checks, and a client certificate of the P2S issuing CA (vpnrouter_pki) with the
+user name as its common name, which OpenVPN and IKEv2 accept; the certificate is the entry's
+userCertificate, and the PKI keeps it with its key. A Manager-only account is an account,
 simpleSecurityObject and vpnRouterAccount (the package's schema) with a name, a password and
 optionally an e-mail address, no names, no certificate and so no VPN access; it is added when
 neither the first nor the last name is given, and can sign in to the web service. A service
 account is a Manager-only account with the scope SERVICE_SCOPE in vpnRouterScope, which another
-system signs in with to use a router service, and which cannot sign in to the web service. The
-internal service accounts are those the router creates and manages for its own services
-(internal_accounts); vpn-router-setup keeps the metrics service's.
+system signs in with to use a router service, and which cannot sign in to the web service; it has
+a display name and a description (labels), in displayName and description of vpnRouterAccount. The
+internal service accounts are those the router creates and manages for its own services, labels
+included (internal_accounts); vpn-router-setup keeps the metrics service's.
 Users exist whether or not a P2S system is enabled.
 
 A group is a groupOfNames in ou=groups with a name, which follows the rules of user names, an
@@ -18,6 +20,10 @@ optional description and at least one member; a group cannot be empty, so the la
 cannot leave it and a user who is the last member of a group cannot be removed. Groups only
 record membership; nothing on the router reads them.
 
+A VPN user may have WireGuard peers, each a device with its public key and its IPs, in
+vpnRouterWireGuardPeer; vpn-router-setup writes a [Peer] of wg0.conf for each peer of a user who
+is not disabled.
+
 A user may have a TOTP token: the user entry itself is an oathTOTPUser and oathTOTPToken whose
 oathTOTPToken points to itself, with the secret in oathSecret and the parameters of
 vpnrouter_ldap.TOTP_PARAMS. Enrolment stores nothing until a code of the new secret is
@@ -27,11 +33,16 @@ code of it. slapd's otp overlay then takes the password followed by a code at ev
 A user is disabled when pwdAccountLockedTime holds LOCKED, and locked when the password
 policy has set it after failed binds, for vpnrouter_ldap.LOCKOUT_SECONDS; unlock ends that.
 login() checks a user's password and code with a bind. Members of ADMIN_GROUP manage the
-router through the web service. The module knows only the directory; the callers revoke a
+router through the web service.
+
+A member of ADMIN_GROUP may have console login (console): the Shell page of the Router Manager,
+and SSH and sudo with the directory's password, followed by the code for an enrolled user. The
+console runs as a local account, or as the user's own posixAccount, which the user entry becomes
+and nslcd serves to the system. Leaving ADMIN_GROUP switches it off. The module knows only the directory; the callers revoke a
 user's refresh tokens after the operations of vpnrouter_auth.REVOKING.
 
-Every operation runs in a session(), which holds the lock that serializes changes and the
-connection of the user manager account. A request that cannot be done raises Failure, whose
+Every operation runs in a session(), which holds the lock that serializes changes, the PKI's
+lock too, and the connection of the user manager account. A request that cannot be done raises Failure, whose
 status says why: 2 the request is invalid, 3 the user does not exist, 4 the user exists, 5 a
 login failed, 1 anything else. Answers are dicts with the keys of the JSON answers.
 """
@@ -40,10 +51,11 @@ import base64
 import calendar
 import contextlib
 import fcntl
-import pathlib
+import grp
+import ipaddress
+import pwd
 import re
 import subprocess
-import sys
 import time
 
 import ldap
@@ -53,6 +65,7 @@ import pyotp
 
 import vpnrouter
 import vpnrouter_ldap
+import vpnrouter_pki
 
 #: A user name is one lowercase DNS label, as it is also the common name of the certificate.
 NAME = re.compile(r'^[a-z][a-z0-9-]{0,30}[a-z0-9]$|^[a-z]$')
@@ -65,8 +78,14 @@ EMAIL = re.compile(r'^[^@\s]+@[^@\s]+\.[^@\s]+$')
 EMAIL_MAX = 254
 #: The keys of the person attributes and their LDAP attributes.
 PERSON = (('first_name', 'givenName'), ('last_name', 'sn'), ('email', 'mail'))
+#: The keys of the labels of a service account and their LDAP attributes.
+LABELS = (('display_name', 'displayName'), ('description', 'description'))
 #: The attributes read for a user.
-ATTRIBUTES = ['uid', 'objectClass', 'pwdAccountLockedTime', 'givenName', 'sn', 'mail', 'oathTOTPToken', 'vpnRouterScope']
+ATTRIBUTES = ['uid', 'objectClass', 'pwdAccountLockedTime', 'givenName', 'sn', 'mail', 'oathTOTPToken', 'vpnRouterScope',
+              'displayName', 'description', 'userCertificate;binary', 'vpnRouterConsoleLogin', 'vpnRouterConsoleAccount',
+              'uidNumber', 'vpnRouterWireGuardPeer']
+#: The most WireGuard peers of one user.
+WIREGUARD_PEERS_MAX = 16
 #: The vpnRouterScope of a service account.
 SERVICE_SCOPE = 'service'
 #: The object classes of a VPN user and of a Manager-only account.
@@ -82,12 +101,12 @@ GROUP_ATTRIBUTES = ['cn', 'description', 'member']
 #: The longest group description, in characters.
 DESCRIPTION_MAX = 256
 #: The value of pwdAccountLockedTime that disables an account until it is enabled.
-LOCKED = b'000001010000Z'
+LOCKED = vpnrouter_ldap.DISABLED.encode()
 #: The group whose members manage the router through the web service.
 ADMIN_GROUP = 'admins'
 #: The digits of a TOTP code given to login().
 CODE = re.compile(r'^\d{6}$')
-LOCK_FILE = pathlib.Path('/run/vpn-router/users.lock')
+LOCK_FILE = vpnrouter_pki.LOCK_FILE
 
 
 class Failure(Exception):
@@ -147,13 +166,30 @@ def person(values, required):
     return found
 
 
+def labels(values):
+    """The labels of a service account in values ({display_name, description}), checked, as {LDAP attribute: value}.
+
+    A key whose value is None is not given; '' means none. A display name has at most PERSON_NAME_MAX printable
+    characters and a description at most DESCRIPTION_MAX.
+    """
+    found = {}
+    name = values.get('display_name')
+    if name is not None:
+        if not isinstance(name, str):
+            raise Failure('display_name must be a string', 2)
+        name = name.strip()
+        if len(name) > PERSON_NAME_MAX or any(not character.isprintable() for character in name):
+            raise Failure(f'the display name must have at most {PERSON_NAME_MAX} printable characters', 2)
+        found['displayName'] = name
+    if values.get('description') is not None:
+        found['description'] = check_description(values['description'])
+    return found
+
+
 def dn_of(name):
     return f'uid={name},{vpnrouter_ldap.USERS}'
 
 
-def certificate(name):
-    return vpnrouter.USER_CERT_DIR / f'{name}_cert.pem', vpnrouter.USER_CERT_DIR / f'{name}_key.pem'
-
 
 def entry(connection, name):
     """The attributes of the user's entry; Failure with status 3 when there is none."""
@@ -164,18 +200,6 @@ def entry(connection, name):
         raise Failure(f'user {name} does not exist', 3)
 
 
-def simple_ca(*args):
-    result = subprocess.run([sys.executable, str(vpnrouter.SIMPLE_CA), *args], capture_output=True, text=True)
-    if result.returncode != 0:
-        raise Failure(f'simple-ca {args[0]} failed: {result.stderr.strip() or result.stdout.strip()}')
-
-
-def publish_crl():
-    """Give strongSwan the CRL after a revocation; OpenVPN reads it at every connection."""
-    if vpnrouter.install_file(vpnrouter.PKI_DIR / 'crl.pem', vpnrouter.CRL_DEST, 0o644):
-        subprocess.run(['swanctl', '--load-creds'], capture_output=True, text=True)
-
-
 def locked_since(value):
     """The time a pwdAccountLockedTime value names, in seconds since the epoch, or 0 when it names none."""
     try:
@@ -195,17 +219,23 @@ def service(attributes):
 
 
 def internal_accounts():
-    """The names of the internal service accounts, which the router creates and manages for its own services: the one
-    metrics.service_account names while metrics are enabled."""
+    """The internal service accounts, which the router creates and manages for its own services, by name, each with
+    the labels the router gives it ({display_name, description}): the one metrics.service_account names while metrics
+    are enabled."""
     try:
         metrics = vpnrouter.load_config()['metrics']
     except SystemExit:
-        return set()
-    return {metrics['service_account']} if metrics['enabled'] else set()
+        return {}
+    if not metrics['enabled']:
+        return {}
+    return {metrics['service_account']: {
+        'display_name': 'Metrics',
+        'description': 'The account an OpenTelemetry Collector signs in with to read /metrics of the metrics service.',
+    }}
 
 
 def summary(attributes):
-    """A user as the answers show it; a person attribute the entry does not have is None.
+    """A user as the answers show it; a person attribute or a label the entry does not have is None.
 
     internal is whether it is an internal service account (internal_accounts).
     """
@@ -218,15 +248,183 @@ def summary(attributes):
         'internal': service(attributes) and name in internal_accounts(),
         'enabled': lock != LOCKED,
         'locked': lock not in (None, LOCKED) and locked_since(lock) > time.time() - vpnrouter_ldap.LOCKOUT_SECONDS,
-        'certificate': certificate(name)[0].is_file(),
+        'certificate': 'userCertificate;binary' in attributes,
         'otp': 'oathTOTPToken' in attributes,
+        'console': console_of(attributes),
+        'wireguard_peers': peers_of(attributes),
     }
-    for key, attribute in PERSON:
+    for key, attribute in PERSON + LABELS:
         values = attributes.get(attribute)
         user[key] = values[0].decode() if values else None
     return user
 
 
+def console_of(attributes):
+    """The console login of an entry as the answers show it: None when it was never set, else {enabled, account, local,
+    uid}: account the system account the console runs as, the local one of vpnRouterConsoleAccount (local true) or the
+    user's own posixAccount, and uid the uidNumber of that posixAccount, None without one."""
+    if 'vpnRouterConsoleLogin' not in attributes:
+        return None
+    local = attributes.get('vpnRouterConsoleAccount')
+    number = attributes.get('uidNumber')
+    return {
+        'enabled': attributes['vpnRouterConsoleLogin'] == [b'TRUE'],
+        'account': local[0].decode() if local else attributes['uid'][0].decode(),
+        'local': bool(local),
+        'uid': int(number[0]) if number else None,
+    }
+
+
+def peers_of(attributes):
+    """The WireGuard peers of an entry as the answers show them: [{public_key, ips}], in the order they are stored."""
+    peers = []
+    for value in attributes.get('vpnRouterWireGuardPeer', []):
+        key, _, ips = value.decode().partition(' ')
+        peers.append({'public_key': key, 'ips': ips.split(',')})
+    return peers
+
+
+def checked_peers(connection, name, peers):
+    """The values of vpnRouterWireGuardPeer for the user's WireGuard peers, [{public_key, ips}], when they are valid.
+
+    A public key is 32 bytes in base64, used by no other peer of any user; each peer has at least one IP, an IPv4
+    address or network, which no other peer of any user covers and which does not cover the router's own address of
+    wireguard.address. A user has at most WIREGUARD_PEERS_MAX peers.
+    """
+    if not isinstance(peers, list) or len(peers) > WIREGUARD_PEERS_MAX:
+        raise Failure(f'wireguard_peers must be a list of at most {WIREGUARD_PEERS_MAX} peers', 2)
+    router = vpnrouter.load_config()['wireguard']['address'].strip()
+    taken = [(other['name'], key, network)
+             for other in list_users(connection)['users'] if other['name'] != name
+             for peer in other['wireguard_peers'] for key in [peer['public_key']]
+             for network in (ipaddress.ip_network(ip) for ip in peer['ips'])]
+    values = []
+    for peer in peers:
+        key = peer.get('public_key') if isinstance(peer, dict) else None
+        ips = peer.get('ips') if isinstance(peer, dict) else None
+        try:
+            if not isinstance(key, str) or len(base64.b64decode(key.strip(), validate=True)) != 32:
+                raise ValueError
+        except ValueError:
+            raise Failure(f'{key!r} is not a WireGuard public key: 32 bytes in base64', 2)
+        key = key.strip()
+        if not isinstance(ips, list) or not ips or not all(isinstance(ip, str) for ip in ips):
+            raise Failure(f'the peer {key} needs at least one IP', 2)
+        networks = []
+        for ip in ips:
+            try:
+                network = ipaddress.ip_network(ip.strip(), strict=True)
+            except ValueError:
+                raise Failure(f'{ip!r} is not an IPv4 address or network of the peer {key}', 2)
+            if network.version != 4:
+                raise Failure(f'{ip!r} of the peer {key} is not IPv4', 2)
+            if router and ipaddress.ip_interface(router).ip in network:
+                raise Failure(f'{network} of the peer {key} covers the router\'s own address {router}', 2)
+            for owner, other_key, other in taken:
+                if other_key == key:
+                    raise Failure(f'the key {key} is a peer of {owner}', 4)
+                if network.overlaps(other):
+                    raise Failure(f'{network} of the peer {key} overlaps {other} of {owner}', 4)
+            networks.append(network)
+        taken += [(name, key, network) for network in networks]
+        values.append(f'{key} {",".join(str(network) for network in networks)}'.encode())
+    return values
+
+
+def classes(attributes):
+    """The object classes of an entry, in lower case."""
+    return {value.decode().lower() for value in attributes.get('objectClass', [])}
+
+
+def free_uid(connection):
+    """The lowest uidNumber from vpnrouter_ldap.CONSOLE_UID_MIN above every posixAccount's that no local account has."""
+    found = connection.search_s(vpnrouter_ldap.USERS, ldap.SCOPE_ONELEVEL, '(uidNumber=*)', ['uidNumber'])
+    number = max([vpnrouter_ldap.CONSOLE_UID_MIN - 1] + [int(attributes['uidNumber'][0]) for _, attributes in found]) + 1
+    while True:
+        try:
+            pwd.getpwuid(number)
+        except KeyError:
+            return number
+        number += 1
+
+
+def console(connection, name, enabled, account=None):
+    """Switch the console login of a member of ADMIN_GROUP on, as the local account given or, without one, as the
+    user's own posixAccount, or off.
+
+    The posixAccount is added the first time and kept when the console login is switched off, so its uidNumber and the
+    home it owns stay the user's. A local account must exist in the system's passwd with a uid from 1000 to below
+    vpnrouter_ldap.CONSOLE_UID_MIN, and not be nobody; the user's own account needs a name no local account has.
+    Switching off ends the sessions of the user's own account.
+    """
+    current = entry(connection, name)
+    if not isinstance(enabled, bool):
+        raise Failure('enabled must be true or false', 2)
+    if account is not None and (not isinstance(account, str) or not account):
+        raise Failure('account must be the name of a local account', 2)
+    changes = [] if 'vpnrouteraccount' in classes(current) else [(ldap.MOD_ADD, 'objectClass', [b'vpnRouterAccount'])]
+    if not enabled:
+        if 'vpnRouterConsoleLogin' not in current:
+            return summary(current)
+        connection.modify_s(dn_of(name), changes + [(ldap.MOD_REPLACE, 'vpnRouterConsoleLogin', [b'FALSE'])])
+        end_sessions(current)
+        return summary(entry(connection, name))
+    if service(current):
+        raise Failure(f'{name} is a service account, which has no console', 2)
+    if ADMIN_GROUP not in groups_of(connection, name):
+        raise Failure(f'user {name} is not a member of {ADMIN_GROUP}', 2)
+    if account is not None:
+        try:
+            local = pwd.getpwnam(account)
+        except KeyError:
+            raise Failure(f'there is no local account {account}', 2)
+        if not 1000 <= local.pw_uid < vpnrouter_ldap.CONSOLE_UID_MIN or account == 'nobody':
+            raise Failure(f'{account} is not a local user account with a uid from 1000 to {vpnrouter_ldap.CONSOLE_UID_MIN - 1}', 2)
+        changes.append((ldap.MOD_REPLACE, 'vpnRouterConsoleAccount', [account.encode()]))
+    else:
+        changes.append((ldap.MOD_REPLACE, 'vpnRouterConsoleAccount', []))
+        if 'posixaccount' not in classes(current):
+            try:
+                pwd.getpwnam(name)
+            except KeyError:
+                pass
+            else:
+                raise Failure(f'a local account {name} exists; give it as the account, or use another user', 4)
+            try:
+                group = grp.getgrnam(vpnrouter_ldap.CONSOLE_GROUP).gr_gid
+            except KeyError:
+                raise Failure(f'the group {vpnrouter_ldap.CONSOLE_GROUP} does not exist yet; vpn-router-setup creates it')
+            changes += [
+                (ldap.MOD_ADD, 'objectClass', [b'posixAccount']),
+                (ldap.MOD_REPLACE, 'uidNumber', [str(free_uid(connection)).encode()]),
+                (ldap.MOD_REPLACE, 'gidNumber', [str(group).encode()]),
+                (ldap.MOD_REPLACE, 'homeDirectory', [f'{vpnrouter_ldap.CONSOLE_HOMES}/{name}'.encode()]),
+                (ldap.MOD_REPLACE, 'loginShell', [vpnrouter_ldap.CONSOLE_SHELL.encode()]),
+            ]
+            if manager_only(current):
+                changes.append((ldap.MOD_REPLACE, 'cn', [name.encode()]))
+    changes.append((ldap.MOD_REPLACE, 'vpnRouterConsoleLogin', [b'TRUE']))
+    connection.modify_s(dn_of(name), changes)
+    return summary(entry(connection, name))
+
+
+def end_sessions(attributes):
+    """End the login sessions of the user's own posixAccount, when the entry has one; those of a local account stay."""
+    if 'posixaccount' in classes(attributes) and not attributes.get('vpnRouterConsoleAccount'):
+        subprocess.run(['loginctl', 'terminate-user', attributes['uid'][0].decode()], capture_output=True)
+
+
+def console_off(connection, names):
+    """Switch the console login off for each of the users that has it on; for those who leave ADMIN_GROUP."""
+    for name in names:
+        try:
+            current = entry(connection, name)
+        except Failure:
+            continue
+        if current.get('vpnRouterConsoleLogin') == [b'TRUE']:
+            console(connection, name, False)
+
+
 def common_name(attributes, name):
     """The cn of an entry: the first and the last name, or the user name without them."""
     full = ' '.join(value for value in (attributes.get('givenName'), attributes.get('sn')) if value)
@@ -242,17 +440,20 @@ def list_users(connection):
 def add(connection, name, password, values, service=False):
     """Add a user: a VPN user with its certificate when values gives all three person attributes, a Manager-only account
     with at most the e-mail address when it gives neither name, and, with service, a service account, with at most the
-    e-mail address too."""
+    e-mail address and its labels (labels)."""
     check_name(name)
     details = person(values, required=False)
     vpn_user = 'givenName' in details or 'sn' in details
     if service and vpn_user:
         raise Failure('a service account has no first or last name', 2)
+    if service:
+        details.update({attribute: value for attribute, value in labels(values).items() if value})
     if vpn_user and len(details) != len(PERSON):
         raise Failure('give first_name, last_name and email for a VPN user, or at most email for a Manager-only account', 2)
     check_password(password)
-    if vpn_user and not (vpnrouter.PKI_DIR / 'ca_key.pem').is_file():
-        raise Failure('the router CA does not exist; vpn-router-setup creates it once a platform is chosen')
+    if vpn_user and not vpnrouter_pki.ready('p2s'):
+        raise Failure('the P2S issuing CA has no certificate yet; vpn-router-setup creates it once a platform is chosen, '
+                      'or, while the root CA is offline, once its certificate is imported')
     if vpn_user:
         record = {'objectClass': VPN_USER_CLASSES, 'uid': [name.encode()], 'cn': [common_name(details, name).encode()]}
     else:
@@ -267,20 +468,26 @@ def add(connection, name, password, values, service=False):
         raise Failure(f'user {name} exists', 4)
     connection.passwd_s(dn_of(name), None, password)
     if vpn_user:
-        vpnrouter.USER_CERT_DIR.mkdir(mode=0o700, parents=True, exist_ok=True)
-        for path in certificate(name):
-            path.unlink(missing_ok=True)
-        simple_ca('make-cert', '--ca-dir', str(vpnrouter.PKI_DIR), '--cert-dir', str(vpnrouter.USER_CERT_DIR), name)
+        try:
+            vpnrouter_pki.issue_user(vpnrouter.load_config(), name, details['mail'])
+        except vpnrouter_pki.Failure as failure:
+            raise Failure(f'the certificate cannot be issued: {failure}', failure.status)
     return summary(entry(connection, name))
 
 
 def update(connection, name, values):
-    """Change the person attributes values gives; the cn follows the first and the last name.
+    """Change the person attributes values gives, the cn following the first and the last name, and of a VPN user the
+    WireGuard peers, wireguard_peers, which replace the user's peers (checked_peers).
 
-    A Manager-only account has only the e-mail address, which '' removes.
+    A Manager-only account has only the e-mail address, which '' removes; a service account also its labels
+    (update_service).
     """
     current = entry(connection, name)
+    if service(current):
+        return update_service(connection, name, values)
     if manager_only(current):
+        if values.get('wireguard_peers') is not None:
+            raise Failure(f'user {name} is a Manager-only account, which has no VPN access and so no WireGuard peers', 2)
         if values.get('first_name') is not None or values.get('last_name') is not None:
             raise Failure(f'user {name} is a Manager-only account, which has no first or last name', 2)
         email = values.get('email')
@@ -293,12 +500,41 @@ def update(connection, name, values):
             connection.modify_s(dn_of(name), [(ldap.MOD_REPLACE, 'mail', [person({'email': email}, required=False)['mail'].encode()])])
         return summary(entry(connection, name))
     details = person(values, required=False)
-    if not details:
-        raise Failure('give at least one of first_name, last_name and email', 2)
-    names = {attribute: current[attribute][0].decode() for attribute in ('givenName', 'sn') if current.get(attribute)}
-    names.update({attribute: details[attribute] for attribute in ('givenName', 'sn') if attribute in details})
-    changes = [(ldap.MOD_REPLACE, attribute, [value.encode()]) for attribute, value in details.items()]
-    changes.append((ldap.MOD_REPLACE, 'cn', [common_name(names, name).encode()]))
+    peers = values.get('wireguard_peers')
+    if not details and peers is None:
+        raise Failure('give at least one of first_name, last_name, email and wireguard_peers', 2)
+    changes = []
+    if details:
+        names = {attribute: current[attribute][0].decode() for attribute in ('givenName', 'sn') if current.get(attribute)}
+        names.update({attribute: details[attribute] for attribute in ('givenName', 'sn') if attribute in details})
+        changes += [(ldap.MOD_REPLACE, attribute, [value.encode()]) for attribute, value in details.items()]
+        changes.append((ldap.MOD_REPLACE, 'cn', [common_name(names, name).encode()]))
+    if peers is not None:
+        if 'vpnrouteraccount' not in classes(current):
+            changes.append((ldap.MOD_ADD, 'objectClass', [b'vpnRouterAccount']))
+        changes.append((ldap.MOD_REPLACE, 'vpnRouterWireGuardPeer', checked_peers(connection, name, peers)))
+    connection.modify_s(dn_of(name), changes)
+    if peers is not None:
+        apply_wireguard()
+    return summary(entry(connection, name))
+
+
+def apply_wireguard():
+    """Have vpn-router-setup write the WireGuard peers of the users into wg0.conf, without waiting for it."""
+    subprocess.run(['systemctl', 'restart', '--no-block', 'vpn-router-setup.service'], capture_output=True)
+
+
+def update_service(connection, name, values):
+    """Change any of the e-mail address and the labels (labels) of a service account that values gives; '' removes one."""
+    if not service(entry(connection, name)):
+        raise Failure(f'{name} is not a service account', 3)
+    changes = [(ldap.MOD_REPLACE, attribute, [value.encode()] if value else []) for attribute, value in labels(values).items()]
+    email = values.get('email')
+    if email is not None:
+        address = '' if isinstance(email, str) and email.strip() == '' else person({'email': email}, required=False)['mail']
+        changes.append((ldap.MOD_REPLACE, 'mail', [address.encode()] if address else []))
+    if not changes:
+        raise Failure('give email, display_name or description', 2)
     connection.modify_s(dn_of(name), changes)
     return summary(entry(connection, name))
 
@@ -311,14 +547,22 @@ def passwd(connection, name, password):
 
 
 def disable(connection, name):
-    if entry(connection, name).get('pwdAccountLockedTime') != [LOCKED]:
+    """Lock the user out; the WireGuard peers of a disabled user are left out of wg0.conf."""
+    current = entry(connection, name)
+    if current.get('pwdAccountLockedTime') != [LOCKED]:
         connection.modify_s(dn_of(name), [(ldap.MOD_REPLACE, 'pwdAccountLockedTime', [LOCKED])])
+        if 'vpnRouterWireGuardPeer' in current:
+            apply_wireguard()
     return summary(entry(connection, name))
 
 
 def enable(connection, name):
-    if entry(connection, name).get('pwdAccountLockedTime') == [LOCKED]:
+    """Let the user in again, with the WireGuard peers."""
+    current = entry(connection, name)
+    if current.get('pwdAccountLockedTime') == [LOCKED]:
         connection.modify_s(dn_of(name), [(ldap.MOD_DELETE, 'pwdAccountLockedTime', None)])
+        if 'vpnRouterWireGuardPeer' in current:
+            apply_wireguard()
     return summary(entry(connection, name))
 
 
@@ -406,37 +650,39 @@ def otp_remove(connection, name):
 
 
 def remove(connection, name):
-    """Remove the user from its groups and the directory, and revoke the certificate.
+    """Remove the user from its groups and the directory, revoke the certificate and end the sessions of its own
+    posixAccount.
 
     A user who is the last member of a group is not removed.
     """
-    entry(connection, name)
+    current = entry(connection, name)
     groups = groups_of(connection, name)
     alone = sorted(group for group, members in groups.items() if members == [name])
     if alone:
         raise Failure(f'user {name} is the last member of {", ".join(alone)}; remove the group first', 2)
     for group in groups:
         connection.modify_s(group_dn(group), [(ldap.MOD_DELETE, 'member', [dn_of(name).encode()])])
-    cert, key = certificate(name)
-    if cert.is_file():
-        simple_ca('revoke-cert', '--ca-dir', str(vpnrouter.PKI_DIR), str(cert))
-        simple_ca('make-crl', '--ca-dir', str(vpnrouter.PKI_DIR), '--days', str(vpnrouter.CRL_DAYS))
-        publish_crl()
-    cert.unlink(missing_ok=True)
-    key.unlink(missing_ok=True)
+    try:
+        vpnrouter_pki.revoke_user(vpnrouter.load_config(), name)
+    except vpnrouter_pki.Failure as failure:
+        raise Failure(f'the certificate cannot be revoked: {failure}', failure.status)
     connection.delete_s(dn_of(name))
+    end_sessions(current)
+    if 'vpnRouterWireGuardPeer' in current:
+        apply_wireguard()
     return {'name': name, 'removed': True}
 
 
 def profile(connection, name):
-    """The OpenVPN client profile of the user, with the CA, the certificate and the key inline."""
+    """The OpenVPN client profile of the user, with the root and the P2S CA, the certificate and the key inline."""
     entry(connection, name)
     cfg = vpnrouter.load_config()
     if not cfg['openvpn']['enabled']:
         raise Failure('OpenVPN is not enabled', 2)
-    cert, key = certificate(name)
-    if not cert.is_file() or not key.is_file():
+    credentials = vpnrouter_pki.user_credentials(name)
+    if credentials is None:
         raise Failure(f'user {name} has no certificate')
+    cert, key = (value.decode() for value in credentials)
     fqdn = cfg['wan']['local_fqdn'].strip()
     text = '\n'.join([
         'client',
@@ -451,9 +697,9 @@ def profile(connection, name):
         'auth-user-pass',
         'auth-nocache',
         'verb 3',
-        '<ca>', extract_pem(vpnrouter.CA_CERT_DEST.read_text(encoding='utf-8')), '</ca>',
-        '<cert>', extract_pem(cert.read_text(encoding='utf-8')), '</cert>',
-        '<key>', key.read_text(encoding='utf-8').strip(), '</key>',
+        '<ca>', extract_pem(vpnrouter_pki.OPENVPN_CA.read_text(encoding='utf-8')), '</ca>',
+        '<cert>', extract_pem(cert), '</cert>',
+        '<key>', key.strip(), '</key>',
         '',
     ])
     return {'name': name, 'profile': text}
@@ -540,10 +786,11 @@ def group_add(connection, name, description, members):
 
 
 def group_update(connection, name, new_name=None, description=None):
-    """Rename the group or change its description ('' removes it); at least one must be given."""
+    """Rename the group or change its description ('' removes it); at least one must be given. Renaming ADMIN_GROUP
+    switches the console login of its members off."""
     if new_name is None and description is None:
         raise Failure('give a new name or a description', 2)
-    group_entry(connection, name)
+    members = member_names(group_entry(connection, name))
     if description is not None:
         description = check_description(description)
         change = (ldap.MOD_REPLACE, 'description', [description.encode()]) if description else \
@@ -555,13 +802,18 @@ def group_update(connection, name, new_name=None, description=None):
             connection.rename_s(group_dn(name), f'cn={new_name}', delold=1)
         except ldap.ALREADY_EXISTS:
             raise Failure(f'group {new_name} exists', 4)
+        if name == ADMIN_GROUP:
+            console_off(connection, members)
         name = new_name
     return group_summary(group_entry(connection, name))
 
 
 def group_remove(connection, name):
-    group_entry(connection, name)
+    """Remove the group; removing ADMIN_GROUP switches the console login of its members off."""
+    members = member_names(group_entry(connection, name))
     connection.delete_s(group_dn(name))
+    if name == ADMIN_GROUP:
+        console_off(connection, members)
     return {'name': name, 'removed': True}
 
 
@@ -574,7 +826,8 @@ def group_member_add(connection, name, user):
 
 
 def group_member_remove(connection, name, user):
-    """Take the user out of the group; the last member cannot leave."""
+    """Take the user out of the group; the last member cannot leave. Leaving ADMIN_GROUP switches the user's console
+    login off."""
     check_name(user)
     members = member_names(group_entry(connection, name))
     if user not in members:
@@ -582,6 +835,8 @@ def group_member_remove(connection, name, user):
     if members == [user]:
         raise Failure(f'user {user} is the last member of group {name}; remove the group instead', 2)
     connection.modify_s(group_dn(name), [(ldap.MOD_DELETE, 'member', [dn_of(user).encode()])])
+    if name == ADMIN_GROUP:
+        console_off(connection, [user])
     return group_summary(group_entry(connection, name))
 
 

debian-package/src/usr/lib/vpn-router/web

@@ -8,8 +8,10 @@ Pages:
   /        the status for people: plain text for curl and wget, a styled page
            (Tailwind CSS from a CDN) for a browser
   /status  the status as JSON
+  /status/full
+           the whole status as JSON, whatever web.status_content says, for the Router Manager
   /config  the configuration without its secrets, and what the router resolved and
-           runs, as JSON
+           runs, with the installed Caddy and where it comes from, as JSON
   /users   the users in the router's directory, whether or not a P2S system is enabled: list,
            add, change, set the password, disable, enable, remove, the OpenVPN client
            profile, and TOTP enrolment (see users()); service accounts are not among them
@@ -24,7 +26,22 @@ Pages:
   /site-to-site
            the site-to-site connections of the configuration: list, add, change and remove,
            applied by vpn-router-setup (see site_to_site())
-  /auth    sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
+  /backup  the backup settings, the last run and the local archives: show, change and run
+           now (see backup())
+  /remote-access
+           the settings of IKEv2 road-warrior, OpenVPN and WireGuard access and whether each
+           runs: show and change, applied by vpn-router-setup (see remote_access())
+  /ca      the PKI: its settings, the root and issuing CAs, the certificates issued; change the
+           settings, issue and revoke certificates, and take the certificate of an issuing CA
+           and a root CRL signed offline (see ca())
+  /pki/<name>.crt, /pki/<name>.crl
+           the DER certificate and CRL of the root (root) and of each issuing CA, which the
+           certificates name in their AIA and CRL distribution points; no authentication
+  /shell   while web.shell is true, a login shell of the user's console account on a terminal, for
+           a member of admins whose console login is on: POST signs the
+           user in again for a one-time ticket (see shell_ticket()), GET with it is a WebSocket
+           that carries the terminal (see Handler.shell())
+  /auth   sign-in with a user's password and TOTP code, refresh and sign-out (see auth())
   /metrics/history
            the metrics the metrics service keeps, for a view: hour, day, month or year (see
            metrics_history())
@@ -32,12 +49,13 @@ Pages:
            the databases of each PostgreSQL cluster on the router with their sizes, as JSON (see
            postgresql_databases()); /config has the clusters' settings
 
-/config, /metrics/history, /postgresql, /users, /service-accounts, /groups, /site-to-site and /account need an HS256 JWT in an Authorization: Bearer header signed
+/status/full, /config, /metrics/history, /postgresql, /users, /service-accounts, /groups, /site-to-site, /backup, /remote-access, /ca, /shell and /account need an HS256 JWT in an Authorization: Bearer header signed
 with vpnrouter_auth.WEB_KEY (see vpnrouter_auth.verify). A token of /auth names a user in sub;
 /account serves that user, and the other paths need a member of vpnrouter_users.ADMIN_GROUP. A
 token of vpn-router-token has the admin claim and names no user; it may call every path but
 /account, and only such a token may change ADMIN_GROUP: create, rename to it, change, remove it,
-add or take out its members, and remove one of its members. These paths and /auth are not
+add or take out its members, and remove one of its members, and switch a user's console login.
+These paths and /auth are not
 served (404) while the key does not exist. /auth is limited to AUTH_LIMIT calls per client
 address in AUTH_WINDOW seconds; the address of a call from one of web.trusted_proxies, by
 default the address the call came in on, is the last entry of its X-Forwarded-For header.
@@ -46,9 +64,9 @@ default the address the call came in on, is the last entry of its X-Forwarded-Fo
 default, the overall status, the time and the client's address (its address as for the rate limit
 below); standard also the package version, the installed version of vpn-router-manager
 (manager_version, null when it is not installed) and the number of active and other services; full
-whether each service runs, whether Docker is installed, and the state of each site-to-site connection, road-warrior
-(IPsec P2S), OpenVPN and WireGuard. No configuration data or key is shown, and no address but the
-client's.
+whether each service runs, whether Docker is installed, how many of the site-to-site connections are established
+(site_to_site: connections and established, null when swanctl cannot be asked), and road-warrior (IPsec P2S), OpenVPN
+and WireGuard. No configuration data, key or connection name is shown, and no address but the client's.
 
 The service first initializes, without listening: it makes the signing key and the refresh
 tokens' database (vpnrouter_auth), retrying every INIT_RETRY_SECONDS until both are ready and
@@ -66,11 +84,24 @@ key, the configuration, and the features of the router and the facts shown by /c
 the router has no features, and /config shows no configuration or interfaces.
 """
 
+import base64
 import collections
+import configparser
+import fcntl
+import hashlib
+import ipaddress
 import json
 import os
+import pwd
+import secrets
+import select
+import shutil
 import signal
+import socket
+import struct
+import subprocess
 import sys
+import termios
 import threading
 import time
 import urllib.parse
@@ -83,8 +114,10 @@ import ldap
 
 import vpnrouter
 import vpnrouter_auth
+import vpnrouter_backup
 import vpnrouter_metrics
 import vpnrouter_net
+import vpnrouter_pki
 import vpnrouter_serve
 import vpnrouter_users
 from vpnrouter_status import established, established_each, openvpn_clients, run, swanctl, wireguard_peers
@@ -115,15 +148,36 @@ REFRESH_SECONDS = 60
 POSTGRESQL_SETTINGS = ('server_version', 'listen_addresses', 'port', 'max_connections', 'shared_buffers',
                        'effective_cache_size', 'work_mem', 'password_encryption', 'ssl', 'timezone')
 
-#: The largest request body accepted, in bytes.
-BODY_LIMIT = 4096
+#: The largest request body accepted, in bytes; a CSR or a certificate chain in PEM is a few kilobytes.
+BODY_LIMIT = 65536
 
 #: The settings of a site_to_site connection that /site-to-site adds and changes.
-CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'psk')
+CONNECTION_SETTINGS = ('addrs', 'id', 'cidrs', 'local_cidrs', 'local_id_mode', 'auth', 'psk', 'remote_ca')
+
+#: The sections of the remote access systems /remote-access changes: IKEv2 road-warrior, OpenVPN and WireGuard.
+REMOTE_ACCESS = ('p2s', 'openvpn', 'wireguard')
 
 #: The HTTP status for each status of a vpnrouter_users.Failure; any other is 500.
 USER_STATUS = {2: 400, 3: 404, 4: 409, 5: 401}
 
+#: The HTTP status for each status of a vpnrouter_pki.Failure; any other is 500.
+PKI_STATUS = {2: 400, 3: 404, 4: 409}
+
+#: A file /pki/ serves: the certificate or the CRL of a CA, and its content type.
+PUBLISHED = {'.crt': 'application/pkix-cert', '.crl': 'application/pkix-crl'}
+
+#: Seconds a ticket of POST /shell may open a shell.
+SHELL_TICKET_SECONDS = 30
+
+#: The largest WebSocket message accepted from a client, in bytes.
+MESSAGE_LIMIT = 65536
+
+#: The GUID of RFC 6455 that the Sec-WebSocket-Accept of a handshake is made with.
+WEBSOCKET_GUID = '258EAFA5-E914-47DA-95CA-C5AB0DC85B11'
+
+#: WebSocket opcodes.
+TEXT, BINARY, CLOSE, PING, PONG = 1, 2, 8, 9, 10
+
 _cache = {'at': 0.0, 'data': None}
 _lock = threading.Lock()
 
@@ -131,6 +185,10 @@ _lock = threading.Lock()
 _auth_calls = collections.defaultdict(collections.deque)
 _auth_lock = threading.Lock()
 
+#: The unused tickets of POST /shell: ticket -> (user, monotonic time of expiry).
+_shell_tickets = {}
+_shell_lock = threading.Lock()
+
 
 def read_json(path):
     """The object in a JSON file, or {} when the file is missing or holds no object."""
@@ -214,8 +272,9 @@ def collect(state):
     }
     names = state.get('site_to_site')
     if isinstance(names, list) and names:
-        status['site_to_site'] = {'connections': {name: None if count is None else count > 0
-                                                  for name, count in established_each(names).items()}}
+        counts = established_each(names).values()
+        status['site_to_site'] = {'connections': len(names),
+                                  'established': None if None in counts else sum(1 for count in counts if count)}
     if state.get('p2s'):
         status['p2s'] = {'clients': established('road-warrior')}
     if state.get('wireguard'):
@@ -343,8 +402,10 @@ def postgresql_databases():
 
 
 def details(state):
-    """What /config shows: the configuration without its secrets, and what the router resolved and runs."""
+    """What /config shows: the configuration without its secrets, and what the router resolved and runs; caddy is the
+    installed Caddy, {version, source}, null when it is not installed."""
     configuration = state.get('configuration', {})
+    caddy = package_version('caddy')
     return {
         'configuration': configuration,
         'network': dict(state.get('network', {}), routes=routes()),
@@ -358,6 +419,9 @@ def details(state):
             'rules': lines_of('iptables', '-S', 'VPN-ROUTER-DOCKER'),
         },
         'postgresql': postgresql_configuration(),
+        # Caddy is upstream's once its repository is configured (vpn-router-caddy).
+        'caddy': {'version': caddy, 'source': 'upstream' if vpnrouter.CADDY_APT_SOURCE.is_file() else 'ubuntu'}
+                 if caddy else None,
     }
 
 
@@ -376,8 +440,9 @@ def text_of(status):
         docker = status['docker']
         lines.append('Docker: not installed' if not docker['installed']
                      else f'Docker: installed, service {docker["service"]}, rules {docker["rules"]}')
-    for name, value in status.get('site_to_site', {}).get('connections', {}).items():
-        lines.append(f'Site to site {name}: {"unknown" if value is None else "established" if value else "not established"}')
+    if 'site_to_site' in status:
+        established, connections = status['site_to_site']['established'], status['site_to_site']['connections']
+        lines.append(f'Site to site: {"unknown" if established is None else established} of {connections} established')
     if 'p2s' in status:
         clients = status['p2s']['clients']
         lines.append(f'Road-warrior (IPsec P2S): {"unknown" if clients is None else f"{clients} connected"}')
@@ -443,10 +508,12 @@ def html_of(status):
 def users(state, method, path, body):
     """Answer a /users request with vpnrouter_users: the HTTP status and the JSON document.
 
-      GET    /users                   the users
+      GET    /users                   the users, and {"enabled", "address"} of wireguard, whose network their
+                                      WireGuard peers take their addresses from
       POST   /users                   add a user: {"name", "password", "first_name", "last_name", "email"};
                                       without the names a Manager-only account
-      PUT    /users/<name>            change any of {"first_name", "last_name", "email"}
+      PUT    /users/<name>            change any of {"first_name", "last_name", "email", "wireguard_peers"};
+                                      wireguard_peers, [{"public_key", "ips"}], replaces the user's peers
       PUT    /users/<name>/password   set the password: {"password": ...}
       POST   /users/<name>/disable    lock the user out of OpenVPN
       POST   /users/<name>/enable     let the user in again
@@ -456,6 +523,8 @@ def users(state, method, path, body):
       POST   /users/<name>/otp        a new TOTP secret and its otpauth URI; nothing is stored
       PUT    /users/<name>/otp        store a TOTP secret: {"secret", "code"}, code a code of the secret
       DELETE /users/<name>/otp        remove the TOTP token
+      PUT    /users/<name>/console    switch console login on or off: {"enabled", "account"?}, account a local account,
+                                      without which the user's own posixAccount; only a token of vpn-router-token
 
     Service accounts are served by /service-accounts: they are not listed, and a request naming one is 404.
     """
@@ -467,7 +536,8 @@ def users(state, method, path, body):
     name = parts[1] if len(parts) > 1 else None
     actions = {
         ('GET', 1, None): lambda connection: {
-            'users': [user for user in vpnrouter_users.list_users(connection)['users'] if not user['service']]},
+            'users': [user for user in vpnrouter_users.list_users(connection)['users'] if not user['service']],
+            'wireguard': {option: vpnrouter.load_config()['wireguard'][option] for option in ('enabled', 'address')}},
         ('POST', 1, None): lambda connection: vpnrouter_users.add(connection, body.get('name'), body.get('password'), body),
         ('PUT', 2, None): lambda connection: vpnrouter_users.update(connection, name, body),
         ('PUT', 3, 'password'): lambda connection: vpnrouter_users.passwd(connection, name, body.get('password')),
@@ -479,6 +549,7 @@ def users(state, method, path, body):
         ('POST', 3, 'otp'): lambda connection: vpnrouter_users.otp_new(connection, name),
         ('PUT', 3, 'otp'): lambda connection: vpnrouter_users.otp_enrol(connection, name, body.get('secret'), body.get('code')),
         ('DELETE', 3, 'otp'): lambda connection: vpnrouter_users.otp_remove(connection, name),
+        ('PUT', 3, 'console'): lambda connection: vpnrouter_users.console(connection, name, body.get('enabled'), body.get('account')),
     }
     # The vpnrouter_users operation of each route that may revoke refresh tokens.
     operations = {('PUT', 3, 'password'): 'passwd', ('POST', 3, 'disable'): 'disable', ('POST', 3, 'unlock'): 'unlock',
@@ -508,8 +579,8 @@ def service_accounts(method, path, body):
     """Answer a /service-accounts request with vpnrouter_users: the HTTP status and the JSON document.
 
       GET    /service-accounts                   the service accounts: {"service_accounts": [...]}
-      POST   /service-accounts                   add one: {"name", "password", "email"?}
-      PUT    /service-accounts/<name>            change the e-mail address: {"email"}; "" removes it
+      POST   /service-accounts                   add one: {"name", "password", "display_name"?, "description"?, "email"?}
+      PUT    /service-accounts/<name>            change any of {"display_name", "description", "email"}; "" removes one
       PUT    /service-accounts/<name>/password   set the password: {"password": ...}
       POST   /service-accounts/<name>/disable    lock it out
       POST   /service-accounts/<name>/enable     let it in again
@@ -525,13 +596,13 @@ def service_accounts(method, path, body):
     parts = path.strip('/').split('/')
     route = (method, len(parts), parts[2] if len(parts) == 3 else None)
     name = parts[1] if len(parts) > 1 else None
-    email = {'email': body.get('email')}
+    settings = {key: body.get(key) for key in ('email', 'display_name', 'description')}
     actions = {
         ('GET', 1, None): lambda connection: {
             'service_accounts': [user for user in vpnrouter_users.list_users(connection)['users'] if user['service']]},
-        ('POST', 1, None): lambda connection: vpnrouter_users.add(connection, body.get('name'), body.get('password'), email,
+        ('POST', 1, None): lambda connection: vpnrouter_users.add(connection, body.get('name'), body.get('password'), settings,
                                                                   service=True),
-        ('PUT', 2, None): lambda connection: vpnrouter_users.update(connection, name, email),
+        ('PUT', 2, None): lambda connection: vpnrouter_users.update_service(connection, name, settings),
         ('PUT', 3, 'password'): lambda connection: vpnrouter_users.passwd(connection, name, body.get('password')),
         ('POST', 3, 'disable'): lambda connection: vpnrouter_users.disable(connection, name),
         ('POST', 3, 'enable'): lambda connection: vpnrouter_users.enable(connection, name),
@@ -575,7 +646,7 @@ def groups(state, method, path, body):
     route = (method, len(parts), parts[2] if len(parts) > 2 else None)
     members = body.get('members') if route == ('POST', 1, None) else [body.get('user')] if route == ('POST', 3, 'members') \
         else [parts[3]] if route == ('DELETE', 4, 'members') else []
-    internal = sorted(vpnrouter_users.internal_accounts().intersection(
+    internal = sorted(set(vpnrouter_users.internal_accounts()).intersection(
         member for member in (members if isinstance(members, list) else []) if isinstance(member, str)))
     if internal:
         return 403, {'error': f'{", ".join(internal)}: internal service accounts, which the router manages, are not group members'}
@@ -617,7 +688,8 @@ def site_to_site(method, path, body):
                                     psk_set, whether psk holds a key, and established, whether its tunnel is up,
                                     null when swanctl cannot be asked
       POST   /site-to-site          add a connection: {"name", "addrs", "id", "cidrs", "local_cidrs", "local_id_mode",
-                                    "psk"}; psk is required, and an existing name is 409
+                                    "auth", "psk", "remote_ca"}; psk is required with auth psk, the default, and an
+                                    existing name is 409
       PUT    /site-to-site/<name>   change any of the settings of POST but name; an empty or absent psk keeps the
                                     current key, and a psk given replaces psk_file
       DELETE /site-to-site/<name>   remove the connection
@@ -647,8 +719,8 @@ def site_to_site(method, path, body):
                     return 400, {'error': 'name is required'}
                 if name in connections:
                     return 409, {'error': f'connection {name} exists'}
-                if not isinstance(settings.get('psk'), str) or not settings['psk']:
-                    return 400, {'error': 'psk is required'}
+                if settings.get('auth', 'psk') == 'psk' and (not isinstance(settings.get('psk'), str) or not settings['psk']):
+                    return 400, {'error': 'psk is required with auth psk'}
                 connections[name] = settings
             elif name not in connections:
                 return 404, {'error': f'no connection {name}'}
@@ -676,6 +748,222 @@ def site_to_site(method, path, body):
     return (201 if method == 'POST' else 200), connection_of(name, cfg['site_to_site'][name], None)
 
 
+def backup_settings(settings):
+    """The backup section as /backup shows it: its settings but pbs_password, with pbs_password_set."""
+    return {**{option: value for option, value in settings.items() if option != 'pbs_password'},
+            'pbs_password_set': bool(settings['pbs_password'])}
+
+
+def rclone_remotes():
+    """The names of the remotes of vpnrouter_backup.RCLONE_CONFIG; [] when it cannot be read, as when it is encrypted."""
+    parser = configparser.ConfigParser(interpolation=None)
+    try:
+        parser.read(vpnrouter_backup.RCLONE_CONFIG, encoding='utf-8')
+    except (OSError, configparser.Error):
+        return []
+    return parser.sections()
+
+
+def backup(method, path, body):
+    """Answer a /backup request: the HTTP status and the JSON document.
+
+      GET  /backup      {"settings", "state", "archives", "next", "client", "rclone"}: the backup section without
+                        pbs_password, with pbs_password_set; the last run (vpnrouter_backup.state), null before the
+                        first; the local archives of this host, newest first, [{name, time, size}], [] with the pbs
+                        target; the next run of the timer as systemd shows it, null while backups are disabled;
+                        whether proxmox-backup-client is installed; and {"installed", "config", "remotes"} of rclone
+      PUT  /backup      change any of the settings of the backup section; an empty or absent pbs_password keeps the
+                        current secret
+      POST /backup/run  start a backup now, without waiting for it; 409 while one runs
+
+    A change is made as /site-to-site makes one, and applied by restarting vpn-router-setup without waiting for it.
+    """
+    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
+        return 400, {'error': 'the body must be a JSON object'}
+    body = body or {}
+    if (method, path) == ('POST', '/backup/run'):
+        if vpnrouter_backup.running():
+            return 409, {'error': 'a backup is running'}
+        result = run('systemctl', 'start', '--no-block', vpnrouter_backup.UNIT)
+        if result is None or result.returncode != 0:
+            return 500, {'error': f'the backup cannot be started: {result.stderr.strip() if result else "no systemctl"}'}
+        return 202, {'started': True}
+    if (method, path) not in (('GET', '/backup'), ('PUT', '/backup')):
+        return 404, {'error': f'no route {method} {path}'}
+    try:
+        if method == 'GET':
+            settings = vpnrouter.load_config()['backup']
+            timer = run('systemctl', 'show', '-p', 'NextElapseUSecRealtime', '--value', vpnrouter_backup.TIMER)
+            next_run = timer.stdout.strip() if timer and timer.returncode == 0 else ''
+            return 200, {
+                'settings': backup_settings(settings),
+                'state': vpnrouter_backup.state() or None,
+                'archives': vpnrouter_backup.archives(settings['path']) if settings['target'] == 'local' else [],
+                'next': next_run if settings['enabled'] and next_run not in ('', 'n/a') else None,
+                'client': vpnrouter_backup.PBS_CLIENT.exists(),
+                'rclone': {'installed': shutil.which('rclone') is not None,
+                           'config': vpnrouter_backup.RCLONE_CONFIG.is_file(), 'remotes': rclone_remotes()},
+            }
+        settings = {option: body[option] for option in vpnrouter.SCHEMA['backup'] if option in body}
+        if not settings.get('pbs_password'):
+            settings.pop('pbs_password', None)
+        with vpnrouter.config_lock():
+            data = vpnrouter.read_settings()
+            current = data.get('backup')
+            data['backup'] = {**(current if isinstance(current, dict) else {}), **settings}
+            cfg = vpnrouter.with_defaults(data)
+            vpnrouter.validate(cfg)
+            vpnrouter.save_config(data)
+    except vpnrouter.ConfigError as exc:
+        return 400, {'error': str(exc)}
+    except OSError as exc:
+        return 500, {'error': f'the configuration cannot be written: {exc}'}
+    except SystemExit as exc:
+        return 500, {'error': str(exc.code)}
+    run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
+    return 200, {'settings': backup_settings(cfg['backup'])}
+
+
+def wireguard_server(cfg, state):
+    """What a WireGuard peer's configuration needs of the router: {public_key, endpoint, allowed_ips}; public_key is
+    null before setup made the key pair, endpoint, <wan.local_fqdn>:<wireguard.listen_port>, null without a name, and
+    allowed_ips the networks reached through the tunnel, the router's local CIDRs and the WireGuard network."""
+    try:
+        public_key = vpnrouter.WG_PUBLIC_KEY.read_text(encoding='utf-8').strip() or None
+    except OSError:
+        public_key = None
+    fqdn = cfg['wan']['local_fqdn'].strip()
+    address = cfg['wireguard']['address'].strip()
+    networks = section(state, 'network').get('local_cidrs')
+    allowed = [cidr for cidr in networks if isinstance(cidr, str)] if isinstance(networks, list) else []
+    if address:
+        allowed.append(str(ipaddress.ip_interface(address).network))
+    return {'public_key': public_key, 'endpoint': f'{fqdn}:{cfg["wireguard"]["listen_port"]}' if fqdn else None,
+            'allowed_ips': list(dict.fromkeys(allowed))}
+
+
+def remote_access(state, method, path, body):
+    """Answer a /remote-access request: the HTTP status and the JSON document.
+
+      GET /remote-access            {"p2s", "openvpn", "wireguard", "running", "local_fqdn", "wireguard_server"}: the
+                                    settings of the three remote access systems (REMOTE_ACCESS), whether setup runs
+                                    each (running: {p2s, openvpn, wireguard}), wan.local_fqdn, which IKEv2 and OpenVPN
+                                    need with the router's VPN server certificate, and what a WireGuard peer's
+                                    configuration needs of the router (wireguard_server)
+      PUT /remote-access/<system>   change any of the settings of the system's section; answers the section
+
+    A change is made as /site-to-site makes one, and applied by restarting vpn-router-setup without waiting for it.
+    """
+    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
+        return 400, {'error': 'the body must be a JSON object'}
+    body = body or {}
+    parts = path.strip('/').split('/')
+    try:
+        if (method, len(parts)) == ('GET', 1):
+            cfg = vpnrouter.load_config()
+            return 200, {**{system: cfg[system] for system in REMOTE_ACCESS},
+                         'running': {system: bool(state.get(system)) for system in REMOTE_ACCESS},
+                         'local_fqdn': cfg['wan']['local_fqdn'],
+                         'wireguard_server': wireguard_server(cfg, state)}
+        if method != 'PUT' or len(parts) != 2 or parts[1] not in REMOTE_ACCESS:
+            return 404, {'error': f'no route {method} {path}'}
+        system = parts[1]
+        settings = {option: body[option] for option in vpnrouter.SCHEMA[system] if option in body}
+        with vpnrouter.config_lock():
+            data = vpnrouter.read_settings()
+            current = data.get(system)
+            data[system] = {**(current if isinstance(current, dict) else {}), **settings}
+            cfg = vpnrouter.with_defaults(data)
+            vpnrouter.validate(cfg)
+            vpnrouter.save_config(data)
+    except vpnrouter.ConfigError as exc:
+        return 400, {'error': str(exc)}
+    except OSError as exc:
+        return 500, {'error': f'the configuration cannot be written: {exc}'}
+    except SystemExit as exc:
+        return 500, {'error': str(exc.code)}
+    run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
+    return 200, cfg[system]
+
+
+def ca(method, path, body):
+    """Answer a /ca request with vpnrouter_pki: the HTTP status and the JSON document.
+
+      GET  /ca                                  {"settings", "templates", "extended_key_usages", "status",
+                                                "certificates"}: the pki section, the templates with the built-in
+                                                ones, the extended key usages, each {oid, builtin}, the root, the
+                                                issuing CAs, the retired CAs and the warnings (vpnrouter_pki.status),
+                                                and the certificates issued, newest first
+      PUT  /ca                                  change any of the settings of the pki section
+      POST /ca/certificates                     issue a certificate: {"ca", "template", "csr"} answers {"serial",
+                                                "certificate", "chain"}; {"ca", "template", "subject", "sans",
+                                                "password"} answers {"serial", "pfx"}, a PKCS#12 file in base64
+      POST /ca/certificates/<serial>/revoke     revoke a certificate: {"reason"?}
+      GET  /ca/bundle/<name>                    the PEM certificates a client trusts the CA with: {"name", "pem"}; for
+                                                root the root alone, for an issuing CA the issuing CA and the root
+      GET  /ca/issuing/<name>/csr               the CSR of an issuing CA that waits for the offline root, with the
+                                                openssl extensions to sign it with: {"name", "csr", "extensions"}
+      PUT  /ca/issuing/<name>/certificate       take its certificate signed by the root: {"certificate"}
+      PUT  /ca/root/crl                         take a root CRL signed offline: {"crl"}
+
+    A change of the settings is made as /site-to-site makes one; it, a revoked router certificate and an imported
+    issuing CA certificate are applied by restarting vpn-router-setup without waiting for it.
+    """
+    if body == 'invalid' or (body is not None and not isinstance(body, dict)):
+        return 400, {'error': 'the body must be a JSON object'}
+    body = body or {}
+    parts = path.strip('/').split('/')
+    route = (method, *parts[1:])
+    try:
+        cfg = vpnrouter.load_config()
+        if len(route) == 3 and route[:2] == ('GET', 'bundle'):
+            return 200, vpnrouter_pki.bundle(route[2])
+        if route == ('GET',):
+            return 200, {'settings': cfg['pki'], 'templates': vpnrouter.pki_templates(cfg),
+                         'extended_key_usages': {name: {'oid': oid, 'builtin': name in vpnrouter.EXTENDED_KEY_USAGES}
+                                                 for name, oid in vpnrouter.extended_key_usages(cfg).items()},
+                         'status': vpnrouter_pki.status(cfg), 'certificates': vpnrouter_pki.certificates()}
+        if route == ('PUT',):
+            settings = {option: body[option] for option in vpnrouter.SCHEMA['pki'] if option in body}
+            with vpnrouter.config_lock():
+                data = vpnrouter.read_settings()
+                current = data.get('pki')
+                data['pki'] = {**(current if isinstance(current, dict) else {}), **settings}
+                cfg = vpnrouter.with_defaults(data)
+                vpnrouter.validate(cfg)
+                vpnrouter.save_config(data)
+            run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
+            return 200, {'settings': cfg['pki'], 'templates': vpnrouter.pki_templates(cfg)}
+        with vpnrouter_pki.locked():
+            if route == ('POST', 'certificates'):
+                return 201, vpnrouter_pki.issue(cfg, body.get('ca'), body.get('template'), csr=body.get('csr'),
+                                                subject=body.get('subject'), sans=body.get('sans'),
+                                                password=body.get('password'))
+            if len(route) == 4 and route[:2] == ('POST', 'certificates') and route[3] == 'revoke':
+                document = vpnrouter_pki.revoke(cfg, route[2], body.get('reason'))
+            elif len(route) == 4 and route[:2] == ('GET', 'issuing') and route[3] == 'csr':
+                return 200, vpnrouter_pki.csr(cfg, route[2])
+            elif len(route) == 4 and route[:2] == ('PUT', 'issuing') and route[3] == 'certificate':
+                document = vpnrouter_pki.import_ca(cfg, route[2], body.get('certificate'))
+            elif route == ('PUT', 'root', 'crl'):
+                return 200, vpnrouter_pki.import_root_crl(body.get('crl'))
+            else:
+                return 404, {'error': f'no route {method} {path}'}
+    except vpnrouter.ConfigError as exc:
+        return 400, {'error': str(exc)}
+    except vpnrouter_pki.Failure as failure:
+        return PKI_STATUS.get(failure.status, 500), {'error': str(failure)}
+    except ldap.LDAPError as exc:
+        return 500, {'error': f'the directory, which holds the PKI, failed: {exc}'}
+    except OSError as exc:
+        return 500, {'error': f'the PKI cannot be changed: {exc}'}
+    except SystemExit as exc:
+        return 500, {'error': str(exc.code)}
+    if route[1] == 'issuing' or document.get('reissue'):
+        run('systemctl', 'restart', '--no-block', 'vpn-router-setup.service')
+    return 200, document
+
+
 def account(name, method, path, body):
     """Answer an /account request of the user named by the token with vpnrouter_users: the HTTP status and the JSON document.
 
@@ -768,8 +1056,11 @@ def refusal(claims, method, path, body):
     with vpnrouter_users.session() as connection:
         if not vpnrouter_users.is_admin(connection, name):
             return f'user {name} is not a member of {admins}'
-        if changes_admins(connection, method, path.strip('/').split('/'), body if isinstance(body, dict) else {}):
+        parts = path.strip('/').split('/')
+        if changes_admins(connection, method, parts, body if isinstance(body, dict) else {}):
             return f'only a token of vpn-router-token may change the group {admins} or remove its members'
+        if parts[0] == 'users' and len(parts) == 3 and parts[2] == 'console' and method != 'GET':
+            return 'only a token of vpn-router-token may change console login'
     return ''
 
 
@@ -810,6 +1101,77 @@ def auth(path, body):
         return 500, {'error': str(exc.code)}
 
 
+def shell_ticket(name, body):
+    """Answer POST /shell: the HTTP status and the JSON document.
+
+    The user named by the token signs in again with {"password", "code"?}; a wrong password or code is 403 and counts
+    as a failed login. The answer is {"ticket", "expires_in"}: a ticket that opens one shell (GET /shell) for the
+    same user within SHELL_TICKET_SECONDS. 403 while web.shell is false or the user's console login is not on.
+    """
+    if not isinstance(name, str):
+        return 403, {'error': 'the shell needs a token of a signed-in user'}
+    if not isinstance(body, dict):
+        return 400, {'error': 'the body must be a JSON object'}
+    try:
+        if not vpnrouter.load_config()['web']['shell']:
+            return 403, {'error': 'the shell is disabled; vpn-config-edit set web.shell true enables it'}
+        if console_account(name) is None:
+            return 403, {'error': f'console login is not enabled for {name}; vpn-router-user console sets it'}
+        vpnrouter_users.login(name, body.get('password'), body.get('code'))
+    except vpnrouter_users.Failure as failure:
+        if failure.status == 5:
+            return 403, {'error': 'the password or the code is wrong'}
+        return USER_STATUS.get(failure.status, 500), {'error': str(failure)}
+    except (ldap.LDAPError, OSError) as exc:
+        return 500, {'error': f'the user directory failed: {exc}'}
+    except SystemExit as exc:
+        return 500, {'error': str(exc.code)}
+    ticket = secrets.token_urlsafe(32)
+    now = time.monotonic()
+    with _shell_lock:
+        for unused in [key for key, (_, expires) in _shell_tickets.items() if expires <= now]:
+            del _shell_tickets[unused]
+        _shell_tickets[ticket] = (name, now + SHELL_TICKET_SECONDS)
+    return 200, {'ticket': ticket, 'expires_in': SHELL_TICKET_SECONDS}
+
+
+def console_account(name):
+    """The system account the console of the user runs as, or None while its console login is not on."""
+    with vpnrouter_users.session() as connection:
+        console = vpnrouter_users.summary(vpnrouter_users.entry(connection, name))['console']
+    return console['account'] if console and console['enabled'] else None
+
+
+def take_ticket(name, ticket):
+    """Whether the ticket of POST /shell is unexpired and was given to the user; it is used up either way."""
+    with _shell_lock:
+        holder, expires = _shell_tickets.pop(ticket, (None, 0.0))
+    return holder == name and expires > time.monotonic()
+
+
+def shell_command(account, unit):
+    """The command that runs the login shell of the system user account in the transient unit, on its terminal.
+
+    setsid makes the terminal the controlling one of systemd-run, which passes the window size on; systemd-run starts
+    the shell outside the web service's sandbox, in a PAM login session of the user.
+    """
+    return ['setsid', '--ctty', 'systemd-run', '--quiet', '--collect', '--pty', '--send-sighup', f'--unit={unit}',
+            f'--uid={account.pw_name}', '--property=PAMName=login', f'--working-directory={account.pw_dir}',
+            '--setenv=TERM=xterm-256color', account.pw_shell or '/bin/sh', '-l']
+
+
+def frame(opcode, payload):
+    """A final, unmasked WebSocket frame of a server."""
+    size = len(payload)
+    if size < 126:
+        length = bytes([size])
+    elif size < 65536:
+        length = bytes([126]) + size.to_bytes(2, 'big')
+    else:
+        length = bytes([127]) + size.to_bytes(8, 'big')
+    return bytes([0x80 | opcode]) + length + payload
+
+
 def auth_wait(address):
     """Seconds until the client address may call /auth again, 0 when it may now; a call that may is counted."""
     now = time.monotonic()
@@ -857,6 +1219,170 @@ class Handler(BaseHTTPRequestHandler):
             return 500, f'the user directory failed: {exc}'
         return (403, reason) if reason else None
 
+    def exact(self, size):
+        """The next size bytes from the client; ConnectionError when it closes first."""
+        data = self.rfile.read(size)
+        if len(data) != size:
+            raise ConnectionError('the client closed the connection')
+        return data
+
+    def message(self, send):
+        """The opcode and the payload of the client's next WebSocket data message, or CLOSE and its payload.
+
+        Fragments are joined and unmasked; a ping is answered with send, a pong ignored. ValueError for an unmasked
+        frame or a message over MESSAGE_LIMIT.
+        """
+        opcode, payload = None, b''
+        while True:
+            head = self.exact(2)
+            code, size = head[0] & 0x0F, head[1] & 0x7F
+            if not head[1] & 0x80:
+                raise ValueError('a frame of the client is not masked')
+            if size == 126:
+                size = int.from_bytes(self.exact(2), 'big')
+            elif size == 127:
+                size = int.from_bytes(self.exact(8), 'big')
+            if len(payload) + size > MESSAGE_LIMIT:
+                raise ValueError(f'a message is larger than {MESSAGE_LIMIT} bytes')
+            mask = self.exact(4) * (size // 4 + 1)
+            data = bytes(byte ^ key for byte, key in zip(self.exact(size), mask))
+            if code == PING:
+                send(PONG, data)
+                continue
+            if code == PONG:
+                continue
+            if code == CLOSE:
+                return CLOSE, data
+            opcode = code if opcode is None else opcode
+            payload += data
+            if head[0] & 0x80:
+                return opcode, payload
+
+    def shell(self, name):
+        """Answer GET /shell?ticket=<ticket>, a WebSocket handshake, with a login shell of the user's console account
+        (vpnrouter_users.console) on a terminal.
+
+        The ticket must come from POST /shell for the user named by the token. Binary messages of the client are its
+        keystrokes, a text message {"cols", "rows"} sets the window size, and binary messages of the server are the
+        terminal's output. The shell ends after web.shell_idle_minutes without a keystroke, when it exits, or when the
+        client closes the connection; the server then closes it with the reason. Each opening, end and refusal is logged
+        with its reason.
+        """
+        def refuse(code, message):
+            log(f'shell of {name} from {self.client()} refused: {message}')
+            body = json.dumps({'error': message}).encode() + b'\n'
+            self.send_response(code)
+            self.send_header('Content-Type', 'application/json')
+            self.send_header('Content-Length', str(len(body)))
+            self.end_headers()
+            self.wfile.write(body)
+
+        key = self.headers.get('Sec-WebSocket-Key', '').strip()
+        if self.headers.get('Upgrade', '').lower() != 'websocket' or 'upgrade' not in self.headers.get('Connection', '').lower() \
+                or self.headers.get('Sec-WebSocket-Version') != '13' or not key:
+            return refuse(400, 'GET /shell must be a WebSocket handshake')
+        query = urllib.parse.parse_qs(urllib.parse.urlsplit(self.path).query)
+        if not take_ticket(name, query.get('ticket', [''])[0]):
+            return refuse(403, 'the ticket is not valid; POST /shell gives one')
+        try:
+            options = vpnrouter.load_config()['web']
+        except SystemExit as exc:
+            return refuse(500, str(exc.code))
+        if not options['shell']:
+            return refuse(403, 'the shell is disabled; vpn-config-edit set web.shell true enables it')
+        try:
+            login = console_account(name)
+        except (vpnrouter_users.Failure, ldap.LDAPError, OSError) as exc:
+            return refuse(500, f'the user directory failed: {exc}')
+        if login is None:
+            return refuse(403, f'console login is not enabled for {name}')
+        try:
+            account = pwd.getpwnam(login)
+        except KeyError:
+            return refuse(500, f'the system does not know the account {login}; is nslcd running?')
+        unit = f'vpn-router-shell-{secrets.token_hex(4)}'
+        master, terminal = os.openpty()
+        try:
+            process = subprocess.Popen(shell_command(account, unit), stdin=terminal, stdout=terminal, stderr=terminal,
+                                       env={'PATH': '/usr/sbin:/usr/bin:/sbin:/bin'})
+        except OSError as exc:
+            os.close(master)
+            return refuse(500, f'the shell cannot be started: {exc}')
+        finally:
+            os.close(terminal)
+        accept = base64.b64encode(hashlib.sha1((key + WEBSOCKET_GUID).encode()).digest()).decode()
+        self.send_response(101, 'Switching Protocols')
+        self.send_header('Upgrade', 'websocket')
+        self.send_header('Connection', 'Upgrade')
+        self.send_header('Sec-WebSocket-Accept', accept)
+        self.end_headers()
+        self.close_connection = True
+        client, started, idle = self.client(), time.monotonic(), options['shell_idle_minutes'] * 60
+        log(f'shell of {name} from {client} opened as {account.pw_name} in {unit}')
+
+        lock, ended, typed = threading.Lock(), threading.Event(), [started]
+
+        def send(opcode, payload):
+            with lock:
+                self.wfile.write(frame(opcode, payload))
+
+        def receive():
+            """Pass the client's keystrokes and window sizes to the terminal until it closes the connection."""
+            try:
+                while True:
+                    opcode, payload = self.message(send)
+                    if opcode == CLOSE:
+                        break
+                    if opcode == BINARY:
+                        os.write(master, payload)
+                        typed[0] = time.monotonic()
+                    elif opcode == TEXT:
+                        size = json.loads(payload)
+                        fcntl.ioctl(master, termios.TIOCSWINSZ, struct.pack('HHHH', int(size['rows']), int(size['cols']), 0, 0))
+            except (OSError, ValueError, KeyError, TypeError, struct.error):
+                pass
+            finally:
+                ended.set()
+
+        reader = threading.Thread(target=receive, name=f'{unit} input', daemon=True)
+        reader.start()
+        reason = 'the shell ended'
+        try:
+            while not ended.is_set():
+                left = typed[0] + idle - time.monotonic()
+                if left <= 0:
+                    reason = f'no keystroke for {options["shell_idle_minutes"]} minutes'
+                    break
+                if select.select([master], [], [], min(left, 1))[0]:
+                    try:
+                        output = os.read(master, 65536)
+                    except OSError:
+                        output = b''
+                    if not output:
+                        break
+                    send(BINARY, output)
+            else:
+                reason = 'the client closed the connection'
+        except OSError:
+            reason = 'the connection failed'
+        run('systemctl', 'stop', unit)
+        try:
+            send(CLOSE, (1000).to_bytes(2, 'big') + reason.encode()[:120])
+        except OSError:
+            pass
+        try:
+            self.connection.shutdown(socket.SHUT_RDWR)
+        except OSError:
+            pass
+        reader.join()
+        os.close(master)
+        try:
+            process.wait(timeout=10)
+        except subprocess.TimeoutExpired:
+            process.kill()
+            process.wait()
+        log(f'shell of {name} from {client} in {unit} ended after {int(time.monotonic() - started)} seconds: {reason}')
+
     def answer(self, send_body):
         path = self.path.split('?', 1)[0]
         extra = []
@@ -864,9 +1390,10 @@ class Handler(BaseHTTPRequestHandler):
         # A body that is not read must not be taken for the next request.
         if self.command not in ('GET', 'HEAD'):
             self.close_connection = True
-        directory = next((name for name in ('users', 'service-accounts', 'groups', 'account', 'site-to-site')
+        directory = next((name for name in ('users', 'service-accounts', 'groups', 'account', 'site-to-site', 'backup',
+                                            'ca', 'shell', 'remote-access')
                           if path == f'/{name}' or path.startswith(f'/{name}/')), None)
-        protected = path in ('/config', '/metrics/history', '/postgresql') or directory is not None
+        protected = path in ('/status/full', '/config', '/metrics/history', '/postgresql') or directory is not None
         signing = path in ('/auth', '/auth/refresh', '/auth/logout')
         state = current() if protected or signing else {}
         claims = self.claims(state['key']) if protected and state['key'] else None
@@ -891,6 +1418,9 @@ class Handler(BaseHTTPRequestHandler):
         elif protected and (refused := self.refusal(claims, path, payload)):
             code, kind = refused[0], 'application/json'
             body = json.dumps({'error': refused[1]}, indent=2).encode() + b'\n'
+        elif path == '/status/full' and self.command in ('GET', 'HEAD'):
+            document = shown(self.status(), 'full', self.client())
+            body, kind, code = json.dumps(document, indent=2).encode() + b'\n', 'application/json', 200
         elif path == '/config' and self.command in ('GET', 'HEAD'):
             body, kind, code = json.dumps(details(state), indent=2).encode() + b'\n', 'application/json', 200
         elif path == '/postgresql' and self.command in ('GET', 'HEAD'):
@@ -899,12 +1429,29 @@ class Handler(BaseHTTPRequestHandler):
             query = urllib.parse.parse_qs(urllib.parse.urlsplit(self.path).query)
             code, document = metrics_history(query.get('range', ['hour'])[0])
             body, kind = json.dumps(document).encode() + b'\n', 'application/json'
+        elif directory == 'shell' and (path, self.command) == ('/shell', 'GET'):
+            return self.shell(claims.get('sub'))
+        elif directory == 'shell':
+            code, document = shell_ticket(claims.get('sub'), payload) if (path, self.command) == ('/shell', 'POST') \
+                else (404, {'error': f'no route {self.command} {path}'})
+            if code != 200:
+                log(f'shell ticket of {claims.get("sub")} from {self.client()} refused: {document["error"]}')
+            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
         elif directory == 'account':
             code, document = account(claims['sub'], self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
         elif directory == 'site-to-site':
             code, document = site_to_site(self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
+        elif directory == 'remote-access':
+            code, document = remote_access(state, self.command, path, payload)
+            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
+        elif directory == 'backup':
+            code, document = backup(self.command, path, payload)
+            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
+        elif directory == 'ca':
+            code, document = ca(self.command, path, payload)
+            body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
         elif directory == 'service-accounts':
             code, document = service_accounts(self.command, path, payload)
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
@@ -913,6 +1460,9 @@ class Handler(BaseHTTPRequestHandler):
             body, kind = json.dumps(document, indent=2).encode() + b'\n', 'application/json'
         elif self.command not in ('GET', 'HEAD'):
             body, kind, code = b'Method not allowed\n', 'text/plain; charset=utf-8', 405
+        elif path.startswith('/pki/') and vpnrouter.PKI_NAME.match(path[5:-4]) and path[-4:] in PUBLISHED and \
+                (vpnrouter_pki.PUBLISH_DIR / path[5:]).is_file():
+            body, kind, code = (vpnrouter_pki.PUBLISH_DIR / path[5:]).read_bytes(), PUBLISHED[path[-4:]], 200
         elif path in ('/status', '/'):
             document = shown(self.status(), section(read_json(CONFIG_FILE), 'web').get('status_content'), self.client())
             agent = self.headers.get('User-Agent', '').lower()

debian-package/src/usr/sbin/vpn-router-backup

@@ -0,0 +1,98 @@
+#!/usr/bin/python3
+"""Make, list and restore backups of the router (vpnrouter_backup).
+
+run makes a backup as backup in /etc/vpn-router/vpn-router.json says, whether or not backups are
+enabled, and prints its result; vpn-router-backup.service runs it on the schedule of its timer.
+list prints the local archives of this host in backup.path, newest first, or with the pbs target
+the snapshots of this host on the Proxmox Backup Server. restore puts back a local archive, or
+with --pbs a snapshot, such as host/router/2026-10-25T03:00:00Z, after showing what it holds and
+asking for yes, which --yes gives; what it replaces is kept in
+/var/lib/vpn-router/backup/before-restore. A failure is a message on standard error; the exit
+status is 2 for an invalid request and 1 for any other failure. -h or --help shows the options.
+
+  vpn-router-backup run
+  vpn-router-backup list
+  vpn-router-backup restore [--yes] ARCHIVE
+  vpn-router-backup restore [--yes] --pbs SNAPSHOT
+"""
+
+import argparse
+import os
+import sys
+
+sys.path.insert(0, '/usr/lib/vpn-router')
+
+import vpnrouter
+import vpnrouter_backup
+
+
+class Parser(argparse.ArgumentParser):
+    """An argument parser whose errors end with status 2."""
+
+    def error(self, message):
+        print(f'{self.prog}: {message}; see {self.prog} --help', file=sys.stderr)
+        sys.exit(2)
+
+
+def confirmed(manifest, yes):
+    """Whether to restore the backup of the manifest: yes, or the answer yes to the question."""
+    print(f'Backup of {manifest.get("host")} made {manifest.get("time")} by vpn-router {manifest.get("version")}:')
+    for item in manifest.get('items', []):
+        print(f'  {item}')
+    if yes:
+        return True
+    return input('Replace the router state with it? Type yes: ').strip() == 'yes'
+
+
+def main(argv):
+    parser = Parser(prog='vpn-router-backup', description='Make, list and restore backups of the router.')
+    commands = parser.add_subparsers(dest='command', required=True, parser_class=Parser)
+    commands.add_parser('run', help='make a backup now')
+    commands.add_parser('list', help='list the backups of this host')
+    restorer = commands.add_parser('restore', help='put a backup back')
+    restorer.add_argument('source', metavar='ARCHIVE|SNAPSHOT', help='a local archive, or with --pbs a snapshot')
+    restorer.add_argument('--pbs', action='store_true', help='restore a snapshot of the Proxmox Backup Server')
+    restorer.add_argument('--yes', action='store_true', help='do not ask before replacing the router state')
+    options = parser.parse_args(argv)
+    os.umask(0o077)
+
+    try:
+        if options.command == 'run':
+            record = vpnrouter_backup.run()
+            if record['result'] == 'failed':
+                print(f'vpn-router-backup: {record["error"]}', file=sys.stderr)
+                return 1
+            print(f'Backup {record["archive"] or record["snapshot"]} made, {record["size"]} bytes.')
+            for name in record['removed']:
+                print(f'Removed {name}.')
+            if record['cloud']:
+                print(f'Cloud copy to {record["cloud"]["remote"]}: {record["cloud"]["error"] or "ok"}.')
+            return 0
+        cfg = vpnrouter.load_config()
+        if options.command == 'list':
+            if cfg['backup']['target'] == 'pbs':
+                print(vpnrouter_backup.snapshots(cfg), end='')
+            else:
+                for item in vpnrouter_backup.archives(cfg['backup']['path']):
+                    print(f'{item["name"]}  {item["size"]}')
+            return 0
+        if options.pbs and options.source.startswith('/'):
+            print('vpn-router-backup: a snapshot is type/id/time, such as host/router/2026-10-25T03:00:00Z',
+                  file=sys.stderr)
+            return 2
+        saved = vpnrouter_backup.restore(options.source, options.pbs, lambda manifest: confirmed(manifest, options.yes))
+    except vpnrouter_backup.Failure as exc:
+        print(f'vpn-router-backup: {exc}', file=sys.stderr)
+        return 1
+    except OSError as exc:
+        print(f'vpn-router-backup: {exc}', file=sys.stderr)
+        return 1
+    if saved is None:
+        print('Nothing restored.')
+        return 1
+    print(f'Restored; what it replaced is in {saved}.')
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))

debian-package/src/usr/sbin/vpn-router-ca

@@ -0,0 +1,212 @@
+#!/usr/bin/python3
+"""Manage the router's PKI, which the router's directory holds, from the command line, with vpnrouter_pki.
+
+status shows the root, the issuing CAs and the warnings; list the certificates the router issued. issue signs a CSR,
+or makes a key and writes a PFX file whose password is read from the first line of standard input. ca csr prints the
+CSR of an issuing CA that waits for the offline root, with the openssl extensions to sign it with, and ca import takes
+the signed certificate. root export-key writes the root key encrypted with the passphrase read from standard input,
+root remove-key removes it from the router, root import-key puts it back, and root import-crl takes a root CRL signed
+offline. maintain signs the stale CRLs again; vpn-router-pki.service runs it daily. A change that needs
+vpn-router-setup restarts it without waiting.
+
+The answer is text for people on standard output, and a failure is a message on standard error. With --json the answer
+is JSON on standard output, and a failure is {"error": ...} there too. The exit status says what failed: 2 the request
+is invalid, 3 something it names does not exist, 4 the state does not allow it, 1 anything else. -h or --help shows the
+commands and their options.
+
+  vpn-router-ca [--json] status
+  vpn-router-ca [--json] list [--ca NAME]
+  vpn-router-ca [--json] issue --ca NAME --template NAME --csr FILE
+  vpn-router-ca [--json] issue --ca NAME --template NAME --subject NAME [--san NAME ...] --pfx FILE   (password on stdin)
+  vpn-router-ca [--json] revoke SERIAL [--reason REASON]
+  vpn-router-ca [--json] maintain
+  vpn-router-ca [--json] ca csr NAME
+  vpn-router-ca [--json] ca import NAME FILE
+  vpn-router-ca [--json] root export-key --out FILE   (passphrase on stdin)
+  vpn-router-ca [--json] root remove-key [--yes]
+  vpn-router-ca [--json] root import-key FILE   (passphrase on stdin, an empty line for none)
+  vpn-router-ca [--json] root import-crl FILE
+"""
+
+import argparse
+import base64
+import json
+import os
+import pathlib
+import subprocess
+import sys
+
+sys.path.insert(0, '/usr/lib/vpn-router')
+
+import ldap
+
+import vpnrouter
+import vpnrouter_pki
+from vpnrouter_pki import Failure
+
+
+class Parser(argparse.ArgumentParser):
+    """An argument parser whose errors end with status 2."""
+
+    def error(self, message):
+        print(f'{self.prog}: {message}; see {self.prog} --help', file=sys.stderr)
+        sys.exit(2)
+
+
+def secret():
+    """The first line of standard input."""
+    return sys.stdin.readline().rstrip('\r\n')
+
+
+def restart_setup():
+    subprocess.run(['systemctl', 'restart', '--no-block', 'vpn-router-setup.service'], capture_output=True, text=True)
+
+
+def show_status(document):
+    root = document['root']
+    if root is None:
+        print('Root CA: none; vpn-router-setup creates it once a platform is chosen')
+    else:
+        print(f'Root CA: {root["subject"]}, expires {root["expires"]}, key {"on the router" if root["key"] else "offline"}'
+              f', CRL until {root["crl_next_update"] or "none"}')
+    for authority in document['authorities']:
+        line = f'Issuing CA {authority["name"]}: {authority["common_name"]}, {authority["state"]}'
+        if authority['expires']:
+            line += f', expires {authority["expires"]}, CRL until {authority["crl_next_update"] or "none"}'
+        line += f', templates {", ".join(authority["templates"])}'
+        if authority['acme_url']:
+            line += f', ACME {authority["acme_url"]}'
+        print(line)
+    for retired in document['retired']:
+        print(f'Retired CA {retired["name"]}: {retired["retired"]}')
+    for warning in document['warnings']:
+        print(f'Warning: {warning}')
+
+
+def run(options):
+    """Do the command of the options; the answer as a document, and a text for people."""
+    cfg = vpnrouter.load_config()
+    if options.command == 'status':
+        document = vpnrouter_pki.status(cfg)
+        return document, None
+    if options.command == 'list':
+        found = [entry for entry in vpnrouter_pki.certificates() if options.ca in (None, entry['ca'])]
+        text = '\n'.join(f'{entry["serial"]}  {entry["ca"]}  {entry["kind"]}  {entry["subject"]}  {entry["state"]}  '
+                         f'{entry["expires"]}' for entry in found)
+        return {'certificates': found}, text
+    with vpnrouter_pki.locked():
+        if options.command == 'issue':
+            if options.csr:
+                document = vpnrouter_pki.issue(cfg, options.ca, options.template,
+                                               csr=pathlib.Path(options.csr).read_text(encoding='ascii'))
+                return document, document['certificate'] + document['chain']
+            if not options.subject or not options.pfx:
+                raise Failure('give --csr, or --subject and --pfx', 2)
+            document = vpnrouter_pki.issue(cfg, options.ca, options.template, subject=options.subject,
+                                           sans=options.san or [], password=secret())
+            out = pathlib.Path(options.pfx)
+            with open(out, 'xb') as handle:
+                handle.write(base64.b64decode(document['pfx']))
+            return {'serial': document['serial'], 'pfx': str(out)}, f'Certificate {document["serial"]} written to {out}.'
+        if options.command == 'revoke':
+            document = vpnrouter_pki.revoke(cfg, options.serial, options.reason)
+            if document['reissue']:
+                restart_setup()
+            return document, f'Certificate {document["serial"]} revoked' + \
+                ('; vpn-router-setup issues a new one.' if document['reissue'] else '.')
+        if options.command == 'maintain':
+            due = vpnrouter_pki.maintain(cfg)
+            if due:
+                restart_setup()
+            return {'renewal': due}, 'CRLs checked' + ('; vpn-router-setup renews the router certificates.' if due else '.')
+        if options.command == 'ca' and options.action == 'csr':
+            document = vpnrouter_pki.csr(cfg, options.name)
+            return document, document['csr'] + '\n' + document['extensions']
+        if options.command == 'ca':
+            document = vpnrouter_pki.import_ca(cfg, options.name, pathlib.Path(options.file).read_text(encoding='ascii'))
+            restart_setup()
+            return document, f'Issuing CA {options.name} has its certificate, which expires {document["expires"]}.'
+        if options.action == 'export-key':
+            data = vpnrouter_pki.export_root_key(secret())
+            out = pathlib.Path(options.out)
+            with open(out, 'xb') as handle:
+                handle.write(data)
+            return {'exported': str(out)}, f'Root key written to {out}, encrypted.'
+        if options.action == 'remove-key':
+            if not options.yes:
+                print('Remove the root key from the router? Keep an exported copy first. Type yes: ', end='',
+                      file=sys.stderr, flush=True)
+                if secret().strip() != 'yes':
+                    return {'removed': False}, 'Nothing removed.'
+            vpnrouter_pki.remove_root_key()
+            return {'removed': True}, 'Root key removed; new issuing CAs now wait for an offline signature.'
+        if options.action == 'import-key':
+            vpnrouter_pki.import_root_key(pathlib.Path(options.file).read_bytes(), secret() or None)
+            restart_setup()
+            return {'imported': True}, 'Root key back on the router.'
+        document = vpnrouter_pki.import_root_crl(pathlib.Path(options.file).read_bytes())
+        return document, f'Root CRL taken, valid until {document["next_update"]}.'
+
+
+def main(argv):
+    parser = Parser(prog='vpn-router-ca', description="Manage the router's PKI.")
+    parser.add_argument('--json', action='store_true', help='answer in JSON')
+    commands = parser.add_subparsers(dest='command', required=True, parser_class=Parser)
+    commands.add_parser('status', help='show the root, the issuing CAs and the warnings')
+    lister = commands.add_parser('list', help='list the certificates the router issued')
+    lister.add_argument('--ca', help='only those of this issuing CA')
+    issuer = commands.add_parser('issue', help='issue a certificate from a CSR, or with a new key into a PFX file')
+    issuer.add_argument('--ca', required=True, help='the issuing CA')
+    issuer.add_argument('--template', required=True, help='the certificate template')
+    issuer.add_argument('--csr', help='the PEM CSR to sign')
+    issuer.add_argument('--subject', help='the common name, without --csr')
+    issuer.add_argument('--san', action='append', help='a subject alternative name, without --csr; repeat for more')
+    issuer.add_argument('--pfx', help='the PFX file to write, without --csr; the password is read from standard input')
+    revoker = commands.add_parser('revoke', help='revoke a certificate the router issued')
+    revoker.add_argument('serial', help='the serial number, hexadecimal')
+    revoker.add_argument('--reason', choices=vpnrouter_pki.REASONS, help='the reason, unspecified by default')
+    commands.add_parser('maintain', help='sign the stale CRLs again')
+    authority = commands.add_parser('ca', help='an issuing CA that waits for the offline root')
+    actions = authority.add_subparsers(dest='action', required=True, parser_class=Parser)
+    actions.add_parser('csr', help='print its CSR and the openssl extensions').add_argument('name')
+    importer = actions.add_parser('import', help='take its certificate signed by the root')
+    importer.add_argument('name')
+    importer.add_argument('file')
+    root = commands.add_parser('root', help='the root CA')
+    root_actions = root.add_subparsers(dest='action', required=True, parser_class=Parser)
+    exporter = root_actions.add_parser('export-key', help='write the root key encrypted with the passphrase from stdin')
+    exporter.add_argument('--out', required=True, help='the file to write')
+    remover = root_actions.add_parser('remove-key', help='remove the root key from the router')
+    remover.add_argument('--yes', action='store_true', help='do not ask')
+    root_actions.add_parser('import-key', help='put the root key back').add_argument('file')
+    root_actions.add_parser('import-crl', help='take a root CRL signed offline').add_argument('file')
+    options = parser.parse_args(argv)
+    os.umask(0o077)
+
+    try:
+        document, text = run(options)
+    except Failure as failure:
+        code, message = failure.status, str(failure)
+    except OSError as exc:
+        code, message = 1, str(exc)
+    except ldap.LDAPError as exc:
+        code, message = 1, f'the directory, which holds the PKI, failed: {exc}'
+    except SystemExit as exc:
+        code, message = 1, str(exc.code)
+    else:
+        if options.json:
+            print(json.dumps(document, indent=2))
+        elif text is None:
+            show_status(document)
+        elif text:
+            print(text.rstrip('\n'))
+        return 0
+    if options.json:
+        print(json.dumps({'error': message}, indent=2))
+    else:
+        print(f'vpn-router-ca: {message}', file=sys.stderr)
+    return code
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))

debian-package/src/usr/sbin/vpn-router-caddy

@@ -0,0 +1,151 @@
+#!/usr/bin/python3
+"""Install Caddy, the router's HTTPS proxy, from the source https.caddy_source names.
+
+status shows the configured source, the source in effect and the installed and candidate versions of Caddy. apply
+installs Caddy when it is missing: from the Ubuntu archive, or with upstream from Caddy's own repository, which it
+configures first (vpnrouter.CADDY_APT_SOURCE, with the key in vpnrouter.CADDY_KEYRING). When upstream is configured
+and the repository is not, it configures the repository and replaces the installed Caddy with upstream's. It then
+restarts vpn-router-setup without waiting, which serves with the new Caddy; vpn-router-caddy.service runs it for
+vpn-router-setup. use-upstream sets https.caddy_source to upstream and applies it, printing each step.
+
+Once the repository is configured Caddy stays upstream's: apt keeps the higher upstream version, and ubuntu has no
+effect. A failure is a message on standard error and the exit status 1. -h or --help shows the commands.
+
+  vpn-router-caddy [--json] status
+  vpn-router-caddy apply
+  vpn-router-caddy use-upstream
+"""
+
+import argparse
+import json
+import os
+import subprocess
+import sys
+import urllib.request
+
+sys.path.insert(0, '/usr/lib/vpn-router')
+
+import vpnrouter
+
+#: apt-get, waiting up to ten minutes for dpkg's lock, which a package installation that runs setup holds.
+APT = ['apt-get', '-o', 'DPkg::Lock::Timeout=600']
+
+#: The options of apt-get install: no questions, and the configuration files of the installed Caddy kept.
+INSTALL = ['-y', '-o', 'Dpkg::Options::=--force-confdef', '-o', 'Dpkg::Options::=--force-confold', 'install']
+
+#: Seconds the key of Caddy's repository may take to download.
+KEY_TIMEOUT = 60
+
+
+class Parser(argparse.ArgumentParser):
+    """An argument parser whose errors end with status 2."""
+
+    def error(self, message):
+        print(f'{self.prog}: {message}; see {self.prog} --help', file=sys.stderr)
+        sys.exit(2)
+
+
+def step(message):
+    print(message, flush=True)
+
+
+def installed():
+    """The installed version of caddy, or None when it is not installed."""
+    result = subprocess.run(['dpkg-query', '-W', '-f=${Status}\t${Version}', 'caddy'], capture_output=True, text=True)
+    status, _, version = result.stdout.partition('\t')
+    return version if result.returncode == 0 and status == 'install ok installed' else None
+
+
+def candidate():
+    """The version of caddy apt would install, or None when it knows none."""
+    result = subprocess.run(['apt-cache', 'policy', 'caddy'], capture_output=True, text=True)
+    for line in result.stdout.splitlines():
+        if line.strip().startswith('Candidate:'):
+            value = line.split(':', 1)[1].strip()
+            return None if value == '(none)' else value
+    return None
+
+
+def effective():
+    """The source Caddy comes from: upstream once its repository is configured, ubuntu otherwise."""
+    return 'upstream' if vpnrouter.CADDY_APT_SOURCE.is_file() else 'ubuntu'
+
+
+def command(args):
+    """Run a command with its output shown; SystemExit when it fails."""
+    step(f'$ {" ".join(args)}')
+    result = subprocess.run(args, env=dict(os.environ, DEBIAN_FRONTEND='noninteractive'))
+    if result.returncode != 0:
+        sys.exit(f'vpn-router-caddy: {args[0]} failed with status {result.returncode}')
+
+
+def apply():
+    """Install Caddy, or replace it with upstream's, as https.caddy_source asks (see the module)."""
+    source = vpnrouter.load_config()['https']['caddy_source']
+    repository = source == 'upstream' and not vpnrouter.CADDY_APT_SOURCE.is_file()
+    if installed() and not repository:
+        if source == 'ubuntu' and effective() == 'upstream':
+            step("https.caddy_source is ubuntu, but Caddy's repository is configured, so Caddy stays upstream's.")
+        else:
+            step(f'Caddy {installed()} is installed from the {source} source.')
+        return
+    if repository:
+        step(f"Downloading the key of Caddy's repository from {vpnrouter.CADDY_KEY_URL}")
+        with urllib.request.urlopen(vpnrouter.CADDY_KEY_URL, timeout=KEY_TIMEOUT) as response:
+            key = response.read()
+        if not key.lstrip().startswith(b'-----BEGIN PGP PUBLIC KEY BLOCK-----'):
+            sys.exit(f'vpn-router-caddy: {vpnrouter.CADDY_KEY_URL} did not answer with an OpenPGP public key')
+        vpnrouter.CADDY_KEYRING.parent.mkdir(mode=0o755, parents=True, exist_ok=True)
+        vpnrouter.CADDY_KEYRING.write_bytes(key)
+        os.chmod(vpnrouter.CADDY_KEYRING, 0o644)
+        vpnrouter.CADDY_APT_SOURCE.write_text(
+            f'Types: deb\nURIs: {vpnrouter.CADDY_REPOSITORY}\nSuites: any-version\nComponents: main\n'
+            f'Signed-By: {vpnrouter.CADDY_KEYRING}\n', encoding='utf-8')
+        os.chmod(vpnrouter.CADDY_APT_SOURCE, 0o644)
+        step(f"Caddy's repository is configured in {vpnrouter.CADDY_APT_SOURCE}.")
+    command([*APT, 'update'])
+    command([*APT, *INSTALL, 'caddy'])
+    step(f'Caddy {installed()} is installed from the {effective()} source.')
+    subprocess.run(['systemctl', 'restart', '--no-block', 'vpn-router-setup.service'], capture_output=True, text=True)
+    step('vpn-router-setup restarted.')
+
+
+def main(argv):
+    parser = Parser(prog='vpn-router-caddy', description='Install Caddy from the source https.caddy_source names.')
+    parser.add_argument('--json', action='store_true', help='answer status in JSON')
+    commands = parser.add_subparsers(dest='command', required=True, parser_class=Parser)
+    commands.add_parser('status', help='show the sources and the versions of Caddy')
+    commands.add_parser('apply', help='install Caddy, or replace it with upstream\'s, as https.caddy_source asks')
+    commands.add_parser('use-upstream', help="switch to Caddy's own repository and replace Caddy with upstream's")
+    options = parser.parse_args(argv)
+
+    try:
+        if options.command == 'status':
+            document = {'configured': vpnrouter.load_config()['https']['caddy_source'], 'source': effective(),
+                        'installed': installed(), 'candidate': candidate()}
+            if options.json:
+                print(json.dumps(document, indent=2))
+            else:
+                print(f'Configured source: {document["configured"]}\nSource in effect: {document["source"]}\n'
+                      f'Installed: {document["installed"] or "no"}\nCandidate: {document["candidate"] or "none"}')
+            return 0
+        if options.command == 'use-upstream':
+            with vpnrouter.config_lock():
+                data = vpnrouter.read_settings()
+                current = data.get('https')
+                data['https'] = {**(current if isinstance(current, dict) else {}), 'caddy_source': 'upstream'}
+                vpnrouter.validate(vpnrouter.with_defaults(data))
+                vpnrouter.save_config(data)
+            step('https.caddy_source is upstream.')
+        apply()
+    except vpnrouter.ConfigError as exc:
+        print(f'vpn-router-caddy: {exc}', file=sys.stderr)
+        return 1
+    except OSError as exc:
+        print(f'vpn-router-caddy: {exc}', file=sys.stderr)
+        return 1
+    return 0
+
+
+if __name__ == '__main__':
+    sys.exit(main(sys.argv[1:]))

debian-package/src/usr/sbin/vpn-router-user

@@ -11,8 +11,10 @@ user exists, 1 anything else. -h or --help shows the commands and their options.
   vpn-router-user [--json] list
   vpn-router-user [--json] add <name> --first-name F --last-name L --email E   (password on stdin)
   vpn-router-user [--json] add <name> [--email E]   (a Manager-only account; password on stdin)
-  vpn-router-user [--json] add <name> --service [--email E]   (a service account; password on stdin)
+  vpn-router-user [--json] add <name> --service [--display-name N] [--description D] [--email E]
+                                                  (a service account; password on stdin)
   vpn-router-user [--json] update <name> [--first-name F] [--last-name L] [--email E]
+  vpn-router-user [--json] update <name> [--display-name N] [--description D] [--email E]   (a service account)
   vpn-router-user [--json] passwd <name>       (password on stdin)
   vpn-router-user [--json] disable <name>
   vpn-router-user [--json] enable <name>
@@ -22,6 +24,7 @@ user exists, 1 anything else. -h or --help shows the commands and their options.
   vpn-router-user [--json] otp-new <name>
   vpn-router-user [--json] otp-enrol <name> <code>   (secret on stdin)
   vpn-router-user [--json] otp-remove <name>
+  vpn-router-user [--json] console <name> (--posix | --account LOCAL | --off)
 """
 
 import argparse
@@ -54,10 +57,14 @@ HELP = {
     'otp-new': 'make a TOTP secret and its otpauth URI; nothing is stored',
     'otp-enrol': 'store the TOTP secret read from standard input, when the code is a code of it',
     'otp-remove': 'remove the TOTP token',
+    'console': "switch the console login of a member of admins on, as the user's own POSIX account in the directory "
+               'or as a local account, or off',
 }
 
 #: The help of the person options.
-PERSON_HELP = {'first_name': 'the first name', 'last_name': 'the last name', 'email': 'the e-mail address'}
+PERSON_HELP = {'first_name': 'the first name', 'last_name': 'the last name', 'email': 'the e-mail address',
+               'display_name': "a service account's display name; '' removes it",
+               'description': "a service account's description; '' removes it"}
 
 
 class Parser(argparse.ArgumentParser):
@@ -76,12 +83,17 @@ def parse(argv):
         if command != 'list':
             sub.add_argument('name', help='the user name')
         if command in ('add', 'update'):
-            for key, _ in vpnrouter_users.PERSON:
+            for key, _ in vpnrouter_users.PERSON + vpnrouter_users.LABELS:
                 sub.add_argument(f'--{key.replace("_", "-")}', dest=key, metavar='TEXT', help=PERSON_HELP[key])
         if command == 'add':
             sub.add_argument('--service', action='store_true', help='add a service account, which cannot sign in to the web service')
         if command == 'otp-enrol':
             sub.add_argument('code', help='a code of the secret from the authenticator')
+        if command == 'console':
+            choice = sub.add_mutually_exclusive_group(required=True)
+            choice.add_argument('--posix', action='store_true', help="run the console as the user's own POSIX account")
+            choice.add_argument('--account', metavar='LOCAL', help='run the console as this local account')
+            choice.add_argument('--off', action='store_true', help='switch console login off')
     return parser.parse_args(argv)
 
 
@@ -95,7 +107,7 @@ def run(connection, options, secret):
     command = options.command
     if command == 'list':
         return vpnrouter_users.list_users(connection)
-    values = {key: getattr(options, key, None) for key, _ in vpnrouter_users.PERSON}
+    values = {key: getattr(options, key, None) for key, _ in vpnrouter_users.PERSON + vpnrouter_users.LABELS}
     if command == 'add':
         return vpnrouter_users.add(connection, options.name, secret, values, service=options.service)
     if command == 'update':
@@ -104,9 +116,18 @@ def run(connection, options, secret):
         return vpnrouter_users.passwd(connection, options.name, secret)
     if command == 'otp-enrol':
         return vpnrouter_users.otp_enrol(connection, options.name, secret, options.code)
+    if command == 'console':
+        return vpnrouter_users.console(connection, options.name, not options.off, options.account)
     return getattr(vpnrouter_users, command.replace('-', '_'))(connection, options.name)
 
 
+def console_text(console):
+    """The console login of a user as a cell: -, off, posix (uid N) or local and the account."""
+    if console is None or not console['enabled']:
+        return '-' if console is None else 'off'
+    return f'local {console["account"]}' if console['local'] else f'posix (uid {console["uid"]})'
+
+
 def text_of(answer):
     """The answer as text for people."""
     if 'profile' in answer:
@@ -118,11 +139,12 @@ def text_of(answer):
     users = answer['users'] if 'users' in answer else [answer]
     if not users:
         return 'no users'
-    head = ('USER', 'KIND', 'STATE', 'CERTIFICATE', 'OTP', 'FIRST NAME', 'LAST NAME', 'E-MAIL')
+    head = ('USER', 'KIND', 'STATE', 'CERTIFICATE', 'OTP', 'CONSOLE', 'FIRST NAME', 'LAST NAME', 'E-MAIL')
     rows = [(user['name'], 'internal' if user['internal'] else 'service' if user['service'] else 'manager' if user['manager_only'] else 'vpn',
              'disabled' if not user['enabled'] else 'locked' if user['locked'] else 'enabled',
              'issued' if user['certificate'] else 'missing',
-             'enrolled' if user['otp'] else '-', user['first_name'] or '-', user['last_name'] or '-', user['email'] or '-')
+             'enrolled' if user['otp'] else '-', console_text(user['console']),
+             user['first_name'] or '-', user['last_name'] or '-', user['email'] or '-')
             for user in users]
     widths = [max(len(row[column]) for row in (head, *rows)) for column in range(len(head))]
     return '\n'.join('  '.join(cell.ljust(width) for cell, width in zip(row, widths)).rstrip() for row in (head, *rows))

debian-package/src/usr/share/doc/vpn-router/vpn-router.json.example

@@ -22,14 +22,23 @@
       "cidrs": ["192.168.0.0/24"],
       "local_cidrs": ["10.0.0.0/24"],
       "local_id_mode": "fqdn",
+      "auth": "psk",
       "psk": "change-me",
-      "psk_file": ""
+      "psk_file": "",
+      "remote_ca": ""
+    },
+    "branch": {
+      "addrs": ["branch.example.org"],
+      "id": "branch.example.org",
+      "cidrs": ["192.168.10.0/24"],
+      "local_cidrs": ["10.0.0.0/24"],
+      "local_id_mode": "fqdn",
+      "auth": "certificate"
     }
   },
   "p2s": {
     "enabled": false,
-    "address_pool": "172.16.0.0/24",
-    "ca_name": "VPN Router CA"
+    "address_pool": "172.16.0.0/24"
   },
   "wireguard": {
     "enabled": false,
@@ -52,13 +61,46 @@
     "port": 7081,
     "database": "",
     "trusted_proxies": [],
-    "status_content": "basic"
+    "status_content": "basic",
+    "shell": false,
+    "shell_idle_minutes": 15
+  },
+  "ssh": {
+    "ldap_login": false
   },
   "https": {
     "enabled": true,
     "email": "",
     "web_port": 7444,
-    "manager_port": 7443
+    "manager_port": 7443,
+    "caddy_source": "ubuntu"
+  },
+  "pki": {
+    "root_name": "VPN Router Root CA",
+    "root_days": 7300,
+    "ca_days": 3650,
+    "key": "rsa-4096",
+    "crl_days": 7,
+    "root_crl_days": 180,
+    "publish": ["http"],
+    "p2s_name": "VPN Router P2S CA",
+    "s2s_name": "VPN Router Site-to-Site CA",
+    "issuing_cas": {
+      "servers": {
+        "name": "VPN Router Server CA",
+        "templates": ["server"],
+        "acme": false
+      }
+    },
+    "templates": {
+      "server": {
+        "days": 397
+      }
+    },
+    "extended_key_usages": {
+      "smartcard_logon": "1.3.6.1.4.1.311.20.2.2"
+    },
+    "root_key_warning": true
   },
   "metrics": {
     "enabled": true,
@@ -74,5 +116,24 @@
     "keep_daily": "3 months",
     "keep_monthly": "1 year",
     "keep_yearly": "10 years"
+  },
+  "backup": {
+    "enabled": false,
+    "schedule": "daily",
+    "target": "local",
+    "path": "/var/backups/vpn-router",
+    "keep_hourly": 24,
+    "keep_daily": 7,
+    "keep_weekly": 4,
+    "keep_monthly": 12,
+    "keep_yearly": 0,
+    "metrics": false,
+    "rclone_remote": "",
+    "rclone_mode": "sync",
+    "pbs_repository": "",
+    "pbs_password": "",
+    "pbs_fingerprint": "",
+    "pbs_namespace": "",
+    "pbs_keyfile": ""
   }
 }

debian-package/src/usr/share/vpn-router/templates/Caddyfile.j2

@@ -4,10 +4,69 @@
 {%- if https_email %}
 	email {{ https_email }}
 {%- endif %}
+{%- if acme_cas %}
+	skip_install_trust
+	pki {
+{%- for ca in acme_cas %}
+		ca {{ ca.id }} {
+			name "{{ ca.name }}"
+			root {
+				cert {{ ca.cert }}
+				key {{ ca.key }}
+			}
+			intermediate {
+				cert {{ ca.cert }}
+				key {{ ca.key }}
+			}
+		}
+{%- endfor %}
+	}
+{%- endif %}
 }
-{% if web_enabled %}
+{% if web_enabled or 'https' in pki_publish or acme_cas %}
 {{ local_fqdn }}:{{ https_web_port }} {
-	reverse_proxy {{ loopback }}:{{ web_port }}
+{%- if 'https' in pki_publish %}
+	handle_path /pki/* {
+		root * {{ pki_publish_dir }}
+		file_server
+	}
+{%- endif %}
+{%- for ca in acme_cas %}
+	handle /acme/{{ ca.id }}/* {
+		acme_server {
+			ca {{ ca.id }}
+		}
+	}
+{%- endfor %}
+	handle {
+{%- if web_enabled %}
+		reverse_proxy {{ loopback }}:{{ web_port }}
+{%- else %}
+		respond 404
+{%- endif %}
+	}
+}
+{% endif %}
+{%- if 'http-80' in pki_publish %}
+http://{{ local_fqdn }} {
+	handle_path /pki/* {
+		root * {{ pki_publish_dir }}
+		file_server
+	}
+	handle {
+		respond 404
+	}
+}
+{% endif %}
+{%- if 'https-default' in pki_publish %}
+{{ local_fqdn }}:443 {
+	handle_path /pki/* {
+		root * {{ pki_publish_dir }}
+		file_server
+	}
+	handle {
+		respond 404
+	}
 }
 {% endif %}
 {%- if manager_port %}

debian-package/src/usr/share/vpn-router/templates/openvpn-server.conf.j2

@@ -5,15 +5,16 @@ dev-type tun
 topology subnet
 server {{ openvpn_network }} {{ openvpn_netmask }}
 
-ca {{ ca_cert }}
+ca {{ openvpn_ca }}
 cert {{ server_cert }}
 key {{ server_key }}
-crl-verify {{ crl }}
+crl-verify {{ openvpn_crl }}
 dh none
 remote-cert-tls client
 
 plugin /usr/lib/openvpn/openvpn-auth-ldap.so {{ openvpn_ldap_conf }}
 script-security 2
+tls-verify /usr/lib/vpn-router/openvpn-issuer
 auth-user-pass-verify /usr/lib/vpn-router/openvpn-same-user via-env
 
 {% for network, netmask in openvpn_routes -%}
@@ -23,6 +24,8 @@ push "route {{ network }} {{ netmask }}"
 push "dhcp-option DNS {{ address }}"
 {% endfor -%}
 
+status {{ openvpn_status }} {{ openvpn_status_seconds }}
+
 keepalive 10 120
 {% if openvpn_protocol == 'udp' -%}
 explicit-exit-notify 1

debian-package/src/usr/share/vpn-router/templates/road-warrior.conf.j2

@@ -8,13 +8,13 @@ connections {
 
     local {
       auth = pubkey
-      certs = server.pem
+      certs = vpn-server.pem
       id = @{{ local_fqdn }}
     }
 
     remote {
       auth = eap-tls
-      cacerts = ca.pem
+      cacerts = p2s.pem
       eap_id = %any
     }
 

debian-package/src/usr/share/vpn-router/templates/site-to-site.conf.j2

@@ -11,12 +11,22 @@ connections {
 
     local {
       id = {{ connection.local_id }}
+{%- if connection.auth == 'certificate' %}
+      auth = pubkey
+      certs = site-to-site.pem
+{%- else %}
       auth = psk
+{%- endif %}
     }
 
     remote {
       id = {{ connection.remote_id }}
+{%- if connection.auth == 'certificate' %}
+      auth = pubkey
+      cacerts = {{ connection.remote_cacert }}
+{%- else %}
       auth = psk
+{%- endif %}
     }
 
     children {
@@ -40,7 +50,7 @@ connections {
 }
 
 secrets {
-{%- for connection in connections if connection.ready %}
+{%- for connection in connections if connection.ready and connection.auth == 'psk' %}
   ike-psk-{{ connection.name }} {
     id-1 = {{ connection.local_id }}
     id-2 = {{ connection.remote_id }}

debian-package/src/usr/share/vpn-router/templates/wg0-peers.conf.j2

@@ -0,0 +1,9 @@
+{{ wg_peers_begin }}
+{% for user, key, ips in wg_peers -%}
+[Peer]
+# {{ user }}
+PublicKey = {{ key }}
+AllowedIPs = {{ ips | join(', ') }}
+
+{% endfor -%}
+{{ wg_peers_end }}

examples/azure/router.tf

@@ -3,7 +3,7 @@ data "http" "repo_gpg_key" {
 }
 
 locals {
-  supply_pki = var.ca_cert_file != ""
+  supply_pki = var.root_cert_file != ""
 
   cloud_init_vars = {
     hostname        = var.name
@@ -27,7 +27,7 @@ locals {
           psk           = var.psk
         }
       }
-      p2s       = { enabled = var.p2s_enabled, address_pool = var.p2s_address_pool, ca_name = "VPN Router CA" }
+      p2s       = { enabled = var.p2s_enabled, address_pool = var.p2s_address_pool }
       wireguard = { enabled = var.wireguard_enabled, address = var.wireguard_address, listen_port = var.wireguard_listen_port }
     }
   }
@@ -102,10 +102,8 @@ resource "azurerm_linux_virtual_machine" "router" {
   custom_data = base64encode(
     local.supply_pki
     ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
-      label       = split(".", var.local_fqdn)[0]
-      ca_cert     = file(var.ca_cert_file)
-      server_cert = file(var.server_cert_file)
-      server_key  = file(var.server_key_file)
+      root_cert = file(var.root_cert_file)
+      root_key  = var.root_key_file != "" ? file(var.root_key_file) : ""
     }))
     : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
   )

examples/azure/variables.tf

@@ -100,20 +100,14 @@ variable "p2s_address_pool" {
   default     = ""
 }
 
-variable "ca_cert_file" {
-  description = "Path to an existing CA certificate PEM to supply instead of letting the package generate one. Leave empty to auto-generate."
+variable "root_cert_file" {
+  description = "Path to an existing root CA certificate PEM to supply instead of letting the package create one. Leave empty to create one."
   type        = string
   default     = ""
 }
 
-variable "server_cert_file" {
-  description = "Path to an existing server certificate PEM, paired with ca_cert_file."
-  type        = string
-  default     = ""
-}
-
-variable "server_key_file" {
-  description = "Path to an existing server private key PEM, paired with ca_cert_file."
+variable "root_key_file" {
+  description = "Path to the private key PEM of root_cert_file. Leave empty to keep the root offline: the issuing CAs then wait for certificates signed elsewhere."
   type        = string
   default     = ""
   sensitive   = true

examples/cloud-init-with-pki.yaml.tpl

@@ -1,12 +1,13 @@
 #cloud-config
 #
 # Example: install and configure vpn-router during first boot, supplying an
-# existing CA and server certificate instead of letting the package generate
-# one. See cloud-init.yaml.tpl for the variant that generates its own CA.
+# existing root CA instead of letting the package create one. See
+# cloud-init.yaml.tpl for the variant that creates its own.
 #
 # Template variables are Terraform templatefile() placeholders. Adapt or drop
-# them for whatever renders this file. <label> is the first component of the
-# FQDN, for example "router" in router.example.com.
+# them for whatever renders this file. With root_key empty the root stays
+# offline: the router's issuing CAs wait for their certificates, signed with
+# the root elsewhere and imported with vpn-router-ca ca import.
 
 hostname: ${hostname}
 fqdn: ${fqdn}
@@ -28,21 +29,18 @@ write_files:
     content: |
       ${jsonencode(config)}
 
-  - path: /etc/vpn-router/pki/ca_cert.pem
+  - path: /etc/vpn-router/pki/root/cert.pem
     permissions: '0644'
     owner: root:root
     content: |
-      ${indent(6, trimspace(ca_cert))}
-  - path: /etc/vpn-router/pki/${label}_cert.pem
-    permissions: '0644'
-    owner: root:root
-    content: |
-      ${indent(6, trimspace(server_cert))}
-  - path: /etc/vpn-router/pki/${label}_key.pem
+      ${indent(6, trimspace(root_cert))}
+%{ if root_key != "" ~}
+  - path: /etc/vpn-router/pki/root/key.pem
     permissions: '0600'
     owner: root:root
     content: |
-      ${indent(6, trimspace(server_key))}
+      ${indent(6, trimspace(root_key))}
+%{ endif ~}
 
 package_update: true
 

examples/cloud-init.yaml.tpl

@@ -10,9 +10,9 @@
 # Template variables are Terraform templatefile() placeholders. Adapt or drop
 # them for whatever renders this file.
 #
-# This variant lets the package generate its own CA on first boot. See
-# cloud-init-with-pki.yaml.tpl for the variant that supplies existing PKI
-# material instead.
+# This variant lets the package create its own CAs on first boot. See
+# cloud-init-with-pki.yaml.tpl for the variant that supplies an existing root
+# CA instead.
 
 hostname: ${hostname}
 fqdn: ${fqdn}

examples/gcp/router.tf

@@ -3,7 +3,7 @@ data "http" "repo_gpg_key" {
 }
 
 locals {
-  supply_pki = var.ca_cert_file != ""
+  supply_pki = var.root_cert_file != ""
 
   cloud_init_vars = {
     hostname        = var.name
@@ -27,16 +27,14 @@ locals {
           psk           = var.psk
         }
       }
-      p2s       = { enabled = var.p2s_enabled, address_pool = var.p2s_address_pool, ca_name = "VPN Router CA" }
+      p2s       = { enabled = var.p2s_enabled, address_pool = var.p2s_address_pool }
       wireguard = { enabled = var.wireguard_enabled, address = var.wireguard_address, listen_port = var.wireguard_listen_port }
     }
   }
 
   cloud_init_rendered = local.supply_pki ? templatefile("${path.module}/../cloud-init-with-pki.yaml.tpl", merge(local.cloud_init_vars, {
-    label       = split(".", var.local_fqdn)[0]
-    ca_cert     = file(var.ca_cert_file)
-    server_cert = file(var.server_cert_file)
-    server_key  = file(var.server_key_file)
+    root_cert = file(var.root_cert_file)
+    root_key  = var.root_key_file != "" ? file(var.root_key_file) : ""
   })) : templatefile("${path.module}/../cloud-init.yaml.tpl", local.cloud_init_vars)
 }
 

examples/gcp/variables.tf

@@ -97,20 +97,14 @@ variable "p2s_address_pool" {
   default     = ""
 }
 
-variable "ca_cert_file" {
-  description = "Path to an existing CA certificate PEM to supply instead of letting the package generate one. Leave empty to auto-generate."
+variable "root_cert_file" {
+  description = "Path to an existing root CA certificate PEM to supply instead of letting the package create one. Leave empty to create one."
   type        = string
   default     = ""
 }
 
-variable "server_cert_file" {
-  description = "Path to an existing server certificate PEM, paired with ca_cert_file."
-  type        = string
-  default     = ""
-}
-
-variable "server_key_file" {
-  description = "Path to an existing server private key PEM, paired with ca_cert_file."
+variable "root_key_file" {
+  description = "Path to the private key PEM of root_cert_file. Leave empty to keep the root offline: the issuing CAs then wait for certificates signed elsewhere."
   type        = string
   default     = ""
   sensitive   = true

examples/install.sh

@@ -26,7 +26,7 @@ REMOTE_CIDRS="${REMOTE_CIDRS:-[\"192.168.0.0/24\"]}"
 PSK="${PSK:-change-me}"
 P2S_ENABLED="${P2S_ENABLED:-false}"
 P2S_ADDRESS_POOL="${P2S_ADDRESS_POOL:-172.16.0.0/24}"
-P2S_CA_NAME="${P2S_CA_NAME:-VPN Router CA}"
+PKI_ROOT_NAME="${PKI_ROOT_NAME:-VPN Router Root CA}"
 WG_ENABLED="${WG_ENABLED:-false}"
 WG_ADDRESS="${WG_ADDRESS:-}"
 WG_LISTEN_PORT="${WG_LISTEN_PORT:-51820}"
@@ -66,8 +66,10 @@ cat > /etc/vpn-router/vpn-router.json <<EOF
   },
   "p2s": {
     "enabled": ${P2S_ENABLED},
-    "address_pool": "${P2S_ADDRESS_POOL}",
-    "ca_name": "${P2S_CA_NAME}"
+    "address_pool": "${P2S_ADDRESS_POOL}"
+  },
+  "pki": {
+    "root_name": "${PKI_ROOT_NAME}"
   },
   "wireguard": {
     "enabled": ${WG_ENABLED},