AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

add ivpn

Browse Source
This commit is contained in:
Dmitriy Kholkin 2023-04-15 03:18:30 +03:00
parent 6a11a39b5e
commit 118277f58d
8 changed files with 346 additions and 1 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

3
machines/AMD-Workstation/default.nix
View File

@ -40,7 +40,8 @@
deviceSpecific.isShared = false;
deviceSpecific.isGaming = true;
deviceSpecific.enableVirtualisation = true;
deviceSpecific.vpn.mullvad.enable = true;
deviceSpecific.vpn.mullvad.enable = false;
deviceSpecific.vpn.ivpn.enable = true;
# hardware.firmware = [ pkgs.rtl8761b-firmware ];
programs.nix-ld.enable = true;

4
modules/devices.nix
View File

@ -81,6 +81,10 @@ with types; {
type = bool;
default = false;
};
ivpn.enable = mkOption {
type = bool;
default = false;
};
tailscale.enable = mkOption {
type = bool;
default = false;

47
modules/ivpn.nix Normal file
View File

@ -0,0 +1,47 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.ivpn;
in {
options.services.ivpn = {
enable = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
This option enables iVPN daemon.
'';
};
};
config = lib.mkIf cfg.enable {
boot.kernelModules = [ "tun" ];
environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
# iVPN writes to /etc/iproute2/rt_tables
networking.iproute2.enable = true;
networking.firewall.checkReversePath = "loose";
systemd.services.ivpn-service = {
description = "iVPN daemon";
wantedBy = [ "multi-user.target" ];
wants = [ "network.target" ];
after = [
"network-online.target"
"NetworkManager.service"
"systemd-resolved.service"
];
path = [
# Needed for mount
"/run/wrappers"
];
startLimitBurst = 5;
startLimitIntervalSec = 20;
serviceConfig = {
ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
Restart = "always";
RestartSec = 1;
};
};
};
}

3
profiles/overlay.nix
View File

@ -50,6 +50,9 @@ with lib; {
# For nix-direnv
nixFlakes = final.nix;
inherit (prev.callPackage ./packages/ivpn/default.nix {}) ivpn ivpn-service;
ivpn-ui = prev.callPackage ./packages/ivpn-ui/default.nix { };
pass-secret-service = prev.pass-secret-service.overrideAttrs (_: {
installCheckPhase = null;
postInstall = ''

83
profiles/packages/ivpn-ui/default.nix Normal file
View File

@ -0,0 +1,83 @@
{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper
, alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo
, cups, dbus, expat, ffmpeg, gdk-pixbuf, glib
, gtk3, libappindicator, libdrm, libGL, libnotify, libxkbcommon
, mesa, nspr, nss, pango, systemd, xorg, wayland
}:
let deps = [
alsa-lib
at-spi2-atk
at-spi2-core
atk
cairo
cups
dbus
expat
ffmpeg
gdk-pixbuf
glib
gtk3
libappindicator
libdrm
libnotify
libxkbcommon
mesa
nspr
nss
pango
systemd
xorg.libX11
xorg.libxcb
xorg.libXcomposite
xorg.libXdamage
xorg.libXext
xorg.libXfixes
xorg.libXrandr
]; in
stdenv.mkDerivation rec {
pname = "ivpn-ui";
version = "3.10.15";
src = fetchurl {
url = "https://repo.ivpn.net/stable/pool/ivpn-ui_${version}_amd64.deb";
hash = "sha256-dcPxhn+YQbEn1pNgOL8Qtu274Lsnvnwu6Rsyst75W8M=";
};
nativeBuildInputs = [
autoPatchelfHook
dpkg
makeWrapper
];
buildInputs = deps;
dontBuild = true;
dontConfigure = true;
unpackPhase = "dpkg-deb -x $src .";
runtimeDependencies = [ (lib.getLib systemd) libGL libnotify libappindicator wayland ];
installPhase = ''
runHook preInstall
mkdir -p $out/bin $out/share/{ivpn,applications}
mv opt/ivpn/ui/* $out/share/ivpn
mv usr/share/* $out/share
ln -s $out/share/ivpn/bin/ivpn-ui $out/bin
mv $out/share/ivpn/IVPN.desktop $out/share/applications/IVPN.desktop
substituteInPlace $out/share/applications/IVPN.desktop \
--replace "/opt/ivpn/ui/bin/ivpn-ui" "$out/bin/ivpn-ui" \
--replace "/opt/ivpn/ui/ivpnicon.svg" "$out/share/applications/ivpnicon.svg"
runHook postInstall
'';
meta = with lib; {
description = "Official IVPN Desktop app";
homepage = "https://www.ivpn.net/apps";
changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
license = licenses.gpl3Only;
maintainers = with maintainers; [ ataraxiasjel ];
};
}

102
profiles/packages/ivpn/default.nix Normal file
View File

@ -0,0 +1,102 @@
{ buildGoModule
, fetchFromGitHub
, lib
, wirelesstools
, makeWrapper
, wireguard-tools
, openvpn
, obfs4
, iproute2
, dnscrypt-proxy2
, iptables
, gawk
, util-linux
}:
builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
inherit pname;
version = "3.10.15";
src = fetchFromGitHub {
owner = "ivpn";
repo = "desktop-app";
rev = "v${version}";
hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
};
nativeBuildInputs = [ makeWrapper ];
ldflags = [
"-s"
"-w"
"-X github.com/ivpn/desktop-app/daemon/version._version=${version}"
"-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
];
patches = [
./path.patch
];
postPatch = ''
substituteInPlace daemon/service/platform/platform_linux_release.go \
--replace 'installDir := "/opt/ivpn"' "installDir := \"$out\""
'';
postInstall = ''
mv $out/bin/{${attrs.modRoot},${pname}}
${lib.optionalString (attrs.modRoot == "daemon") ''
install -Dm700 $src/daemon/References/Linux/etc/client.down "$out/etc/client.down"
install -Dm700 $src/daemon/References/Linux/etc/client.up "$out/etc/client.up"
install -Dm700 $src/daemon/References/Linux/etc/firewall.sh "$out/etc/firewall.sh"
install -Dm700 $src/daemon/References/Linux/etc/splittun.sh "$out/etc/splittun.sh"
install -Dm600 $src/daemon/References/common/etc/servers.json "$out/etc/servers.json"
install -Dm400 $src/daemon/References/common/etc/ca.crt "$out/etc/ca.crt"
install -Dm400 $src/daemon/References/common/etc/ta.key "$out/etc/ta.key"
install -Dm400 $src/daemon/References/common/etc/dnscrypt-proxy-template.toml "$out/etc/dnscrypt-proxy-template.toml"
patchShebangs --build $out/etc/firewall.sh
patchShebangs --build $out/etc/splittun.sh
patchShebangs --build $out/etc/client.down
patchShebangs --build $out/etc/client.up
''}
'';
postFixup = lib.optionalString (pname == "ivpn-service") ''
wrapProgram "$out/bin/ivpn-service" \
--suffix PATH : ${lib.makeBinPath [
wireguard-tools
openvpn
obfs4
iproute2
dnscrypt-proxy2
iptables
gawk
util-linux
]}
'';
meta = with lib; {
description = "Official IVPN Desktop app";
homepage = "https://www.ivpn.net/apps";
changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
license = licenses.gpl3Only;
maintainers = with maintainers; [ urandom ataraxiasjel ];
};
})) {
ivpn = {
modRoot = "cli";
vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
};
ivpn-service = {
modRoot = "daemon";
vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
buildInputs = [
wirelesstools
wireguard-tools
openvpn
obfs4
iproute2
dnscrypt-proxy2
];
};
}

96
profiles/packages/ivpn/path.patch Normal file
View File

@ -0,0 +1,96 @@
diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
index 941a99a7..df821c4d 100644
--- a/daemon/service/platform/platform.go
+++ b/daemon/service/platform/platform.go
@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
}
// checking file permissions
- if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
- errors = append(errors, err)
- }
- if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
- errors = append(errors, err)
- }
if len(openvpnUpScript) > 0 {
if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
errors = append(errors, err)
}
- if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
- errors = append(errors, err)
- }
if len(routeCommand) > 0 {
routeBinary := strings.Split(routeCommand, " ")[0]
diff --git a/daemon/service/platform/platform_linux.go b/daemon/service/platform/platform_linux.go
index 0c2d9850..ec99a352 100644
--- a/daemon/service/platform/platform_linux.go
+++ b/daemon/service/platform/platform_linux.go
@@ -87,8 +87,16 @@ func GetSnapEnvs() *SnapEnvInfo {
// initialize all constant values (e.g. servicePortFile) which can be used in external projects (IVPN CLI)
func doInitConstants() {
- openVpnBinaryPath = "/usr/sbin/openvpn"
- routeCommand = "/sbin/ip route"
+ if p, err := exec.LookPath("openvpn"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ openVpnBinaryPath = p
+ }
+ }
+ if p, err := exec.LookPath("ip"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ routeCommand = p + " route"
+ }
+ }
// check if we are running in snap environment
if envs := GetSnapEnvs(); envs != nil {
diff --git a/daemon/service/platform/platform_linux_release.go b/daemon/service/platform/platform_linux_release.go
index 8b60c46c..cd76f1c9 100644
--- a/daemon/service/platform/platform_linux_release.go
+++ b/daemon/service/platform/platform_linux_release.go
@@ -27,6 +27,8 @@ package platform
import (
"path"
+ "os/exec"
+ "path/filepath"
)
func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
@@ -50,12 +52,28 @@ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
openvpnDownScript = path.Join(installDir, "etc/client.down")
serversFileBundled = path.Join(installDir, "etc/servers.json")
- obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")
+ if p, err := exec.LookPath("obfs4proxy"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ obfsproxyStartScript = p
+ }
+ }
- wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")
- wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")
+ if p, err := exec.LookPath("wg-quick"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ wgBinaryPath = p
+ }
+ }
+ if p, err := exec.LookPath("wg"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ wgToolBinaryPath = p
+ }
+ }
- dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")
+ if p, err := exec.LookPath("dnscrypt-proxy"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ dnscryptproxyBinPath = p
+ }
+ }
dnscryptproxyConfigTemplate = path.Join(installDir, "etc/dnscrypt-proxy-template.toml")
dnscryptproxyConfig = path.Join(tmpDir, "dnscrypt-proxy.toml")

9
profiles/vpn.nix
View File

@ -1,6 +1,7 @@
{ pkgs, lib, config, ... }:
let
isMullvad = config.deviceSpecific.vpn.mullvad.enable;
isIVPN = config.deviceSpecific.vpn.ivpn.enable;
isTailscale = config.deviceSpecific.vpn.tailscale.enable;
in {
config = lib.mkMerge [
@ -16,6 +17,14 @@ in {
persist.cache.directories = [ "/var/cache/mullvad-vpn" ];
})
(lib.mkIf isIVPN {
services.ivpn.enable = true;
home-manager.users.${config.mainuser}.home.packages = [ pkgs.ivpn-ui ];
persist.state.directories = [ "/etc/opt/ivpn" ];
# persist.state.homeFiles = [ ".config/IVPN/ivpn-settings.json" ];
persist.state.homeDirectories = [ ".config/IVPN" ];
})
(lib.mkIf isTailscale {
services.tailscale = {
enable = true;