fix: OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.

ADR.md

@@ -394,8 +394,8 @@ failure, then listens. `vpnrouter_auth` turns every failure of the database into
 psycopg (Ubuntu ships only its pure-Python implementation) finds libpq through the dynamic linker
 cache, which dpkg refreshes with its deferred `ldconfig` only at the end of an installation, so a
 service started during the installation cannot import it yet; a failed import cannot be repeated
-in the same process either, as psycopg caches the lookup. The services therefore import psycopg
+in the same process either, as psycopg caches the lookup. The services and `vpn-router-setup`
-plainly, and their units wait instead: `ExecStartPre=wait-for-libpq`, a shell script of each
+therefore import psycopg plainly, and their units wait instead: `ExecStartPre=wait-for-libpq`, a shell script of each
 package, waits until `ldconfig -p` lists `libpq.so.5`, within `TimeoutStartSec=5min`. The
 maintainer scripts start the units with `systemctl --no-block` (debhelper's start is turned off),
 because a start that waited would hold dpkg before its `ldconfig`.

debian-package/debian/changelog

@@ -1,3 +1,22 @@
+vpn-router (0.33.4-1) unstable; urgency=medium
+
+  fix: OpenVPN starts on a new router, as setup installs CRLs that revoke nothing.
+
+  * A CRL without revoked certificates is installed for strongSwan and
+    OpenVPN.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Wed, 28 Oct 2026 22:00:00 +0100
+
+vpn-router (0.33.3-1) unstable; urgency=medium
+
+  fix: vpn-router-setup runs on a new installation once libpq can be found.
+
+  * The vpn-router-setup unit waits, with wait-for-libpq, until libpq is in
+    the linker cache before it runs setup.
+  * The package starts vpn-router-setup without waiting for it.
+
+ -- Slawomir Koszewski <slawek@koszewscy.waw.pl>  Wed, 28 Oct 2026 21:00:00 +0100
+
 vpn-router (0.33.2-1) unstable; urgency=medium
 
   fix: the router's IPsec remote access is called IKEv2 instead of road-warrior.

debian-package/debian/postinst

@@ -71,9 +71,11 @@ case "$1" in
         # setting the forward policy all belong to vpn-router-setup, which does
         # them only once the configuration says this host is a router.
 
-        # The web service waits for libpq in the linker cache, which dpkg
+        # The setup and web services wait for libpq in the linker cache, which
-        # refreshes after this script, so it is started without waiting for it.
+        # dpkg refreshes after this script, so they are started without waiting
+        # for them.
         if [ -d /run/systemd/system ]; then
+            systemctl --no-block restart vpn-router-setup.service >/dev/null 2>&1 || true
             systemctl --no-block restart vpn-router-web.service >/dev/null 2>&1 || true
         fi
         ;;

debian-package/debian/rules

@@ -3,7 +3,7 @@
 	dh $@
 
 override_dh_installsystemd:
-	dh_installsystemd --name=vpn-router-setup
+	dh_installsystemd --name=vpn-router-setup --no-start
 	dh_installsystemd --name=vpn-router-docker
 	dh_installsystemd --name=vpn-router-web --no-start
 	dh_installsystemd --name=vpn-router-metrics --no-enable --no-start

debian-package/debian/vpn-router.vpn-router-setup.service

@@ -6,6 +6,7 @@ After=network-online.target docker.service postgresql.service
 
 [Service]
 Type=oneshot
+ExecStartPre=/usr/lib/vpn-router/wait-for-libpq
 ExecStart=/usr/lib/vpn-router/setup
 RemainAfterExit=yes
 

debian-package/src/usr/lib/vpn-router/vpnrouter_pki.py

@@ -722,7 +722,7 @@ def install_crls(connection):
     crls = {}
     for name, file in SWANCTL_CA_FILES.items():
         entry = authority(connection, name)
-        crls[name] = entry['crl'].public_bytes(serialization.Encoding.PEM) if entry and entry['crl'] else None
+        crls[name] = entry['crl'].public_bytes(serialization.Encoding.PEM) if entry and entry['crl'] is not None else None
         changed |= write(X509CRL_DIR / file, crls[name], 0o644) if crls[name] else remove(X509CRL_DIR / file)
     if crls['root'] and crls['p2s']:
         changed |= write(OPENVPN_CRL, crls['root'] + crls['p2s'], 0o644)

debian-package/src/usr/lib/vpn-router/wait-for-libpq

@@ -1,6 +1,7 @@
 #!/bin/sh
 # Wait until libpq is in the dynamic linker cache, where psycopg looks it up.
-# ExecStartPre= of vpn-router-web.service; TimeoutStartSec= of the unit bounds the wait.
+# ExecStartPre= of vpn-router-setup.service, vpn-router-web.service and vpn-router-metrics.service;
+# TimeoutStartSec= of the unit bounds the wait.
 
 reported=
 until ldconfig -p | grep -q '^[[:space:]]*libpq\.so\.5 '; do