Users

The users of the router's directory, without the service accounts.

Kinds of users

VPN user: a first name, a last name, an e-mail address and a certificate; signs in to OpenVPN, IKEv2 and WireGuard, and to the Manager.
Manager-only account: a name, a password and an optional e-mail address; no certificate and no VPN access.

OTP: whether the user is enrolled for one-time passwords (TOTP).
Passkeys: how many passkeys the user signs in to the Manager with.
Console: for a member of admins, the console login: off, the user's own POSIX account with its uid, or the local account it runs as; marked as refused while the user is not enrolled for TOTP. Root switches it on the router with vpn-router-user console.

Add: a VPN user, or with Manager access only a Manager-only account.
Edit: the names and the e-mail address of a VPN user, the e-mail address of a Manager-only account.
Password, Disable, Enable, Unlock after failed logins, and Remove.
Profile: downloads the OpenVPN client profile, while the router runs OpenVPN.
Apple VPN profile (Apple icon): downloads a .mobileconfig that sets up the router's IKEv2 VPN on a Mac, iPhone or iPad, while the router runs IKEv2. The password you type protects the user's key in the profile; the device asks for it when the profile is installed.
OTP: enrols an authenticator app with a QR code, stored once a code of the app is entered, or removes the enrolment.
Remove passkeys: removes all the user's passkeys.

Five wrong passwords lock a user for 15 minutes; Unlock ends that sooner.