- ovpmon-helper: new publish-crl command (validated copy of pki/crl.pem to
/etc/openvpn/crl.pem, root:root 644); crl-verify allowlisted only for
that path; CRL is refreshed on service start/restart.
- Profiler: publish after gen-crl (init/revoke) and on server/configure;
generator renders the published path when running unprivileged.
- doas rule for publish-crl; docs and helper copy updated.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
- Profiler: when not root, render server.conf to the staging dir and let
the root helper validate (directive allowlist) and install it; control
the openvpn service through the helper (doas, fixed commands).
- Add ovpmon-helper and doas rules under DOCS/General/privilege-separation.
- Document the design, rollout, results and limitations.
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
