iclaoudezinandClaude Sonnet 5.5 9ffdbfa259 Publish CRL for the unprivileged OpenVPN user so crl_verify works ...

- ovpmon-helper: new publish-crl command (validated copy of pki/crl.pem to
  /etc/openvpn/crl.pem, root:root 644); crl-verify allowlisted only for
  that path; CRL is refreshed on service start/restart.
- Profiler: publish after gen-crl (init/revoke) and on server/configure;
  generator renders the published path when running unprivileged.
- doas rule for publish-crl; docs and helper copy updated.

Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>

2026-09-30 12:38:30 +00:00

..

openrc

new awesome build

2026-01-28 22:37:47 +03:00

privilege-separation

Publish CRL for the unprivileged OpenVPN user so crl_verify works

2026-09-30 12:38:30 +00:00

systemd

new awesome build

2026-01-28 22:37:47 +03:00

Deployment_Docker.md

Compose: require JWT secret, seed admin via env, stop publishing internal ports

2026-09-30 12:14:22 +00:00

Deployment_Native.md

Publish CRL for the unprivileged OpenVPN user so crl_verify works

2026-09-30 12:38:30 +00:00

Deployment.md

Docs: concise README, split deployment guides, add change records

2026-09-30 12:12:09 +00:00

Index.md

Run API services unprivileged; add root helper for OpenVPN config and service control

2026-09-30 12:33:15 +00:00

Nginx_Configuration.md

new awesome build

2026-01-28 22:37:47 +03:00

Security_Architecture.md

Docs: concise README, split deployment guides, add change records

2026-09-30 12:12:09 +00:00

Service_Management.md

new awesome build

2026-01-28 22:37:47 +03:00