add ivpn

machines/AMD-Workstation/default.nix

@@ -40,7 +40,8 @@
   deviceSpecific.isShared = false;
   deviceSpecific.isGaming = true;
   deviceSpecific.enableVirtualisation = true;
-  deviceSpecific.vpn.mullvad.enable = true;
+  deviceSpecific.vpn.mullvad.enable = false;
+  deviceSpecific.vpn.ivpn.enable = true;
 #   hardware.firmware = [ pkgs.rtl8761b-firmware ];
 
   programs.nix-ld.enable = true;

modules/devices.nix

@@ -81,6 +81,10 @@ with types; {
           type = bool;
           default = false;
         };
+        ivpn.enable = mkOption {
+          type = bool;
+          default = false;
+        };
         tailscale.enable = mkOption {
           type = bool;
           default = false;

modules/ivpn.nix

@@ -0,0 +1,47 @@
+{ config, lib, pkgs, ... }:
+with lib;
+let
+  cfg = config.services.ivpn;
+in {
+  options.services.ivpn = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        This option enables iVPN daemon.
+      '';
+    };
+  };
+
+  config = lib.mkIf cfg.enable {
+    boot.kernelModules = [ "tun" ];
+
+    environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
+
+    # iVPN writes to /etc/iproute2/rt_tables
+    networking.iproute2.enable = true;
+    networking.firewall.checkReversePath = "loose";
+
+    systemd.services.ivpn-service = {
+      description = "iVPN daemon";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+      after = [
+        "network-online.target"
+        "NetworkManager.service"
+        "systemd-resolved.service"
+      ];
+      path = [
+        # Needed for mount
+        "/run/wrappers"
+      ];
+      startLimitBurst = 5;
+      startLimitIntervalSec = 20;
+      serviceConfig = {
+        ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
+        Restart = "always";
+        RestartSec = 1;
+      };
+    };
+  };
+}

profiles/overlay.nix

@@ -50,6 +50,9 @@ with lib; {
         # For nix-direnv
         nixFlakes = final.nix;
 
+        inherit (prev.callPackage ./packages/ivpn/default.nix {}) ivpn ivpn-service;
+        ivpn-ui = prev.callPackage ./packages/ivpn-ui/default.nix { };
+
         pass-secret-service = prev.pass-secret-service.overrideAttrs (_: {
           installCheckPhase = null;
           postInstall = ''

profiles/packages/ivpn-ui/default.nix

@@ -0,0 +1,83 @@
+{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper
+, alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo
+, cups, dbus, expat, ffmpeg, gdk-pixbuf, glib
+, gtk3, libappindicator, libdrm, libGL, libnotify, libxkbcommon
+, mesa, nspr, nss, pango, systemd, xorg, wayland
+}:
+
+let deps = [
+  alsa-lib
+  at-spi2-atk
+  at-spi2-core
+  atk
+  cairo
+  cups
+  dbus
+  expat
+  ffmpeg
+  gdk-pixbuf
+  glib
+  gtk3
+  libappindicator
+  libdrm
+  libnotify
+  libxkbcommon
+  mesa
+  nspr
+  nss
+  pango
+  systemd
+  xorg.libX11
+  xorg.libxcb
+  xorg.libXcomposite
+  xorg.libXdamage
+  xorg.libXext
+  xorg.libXfixes
+  xorg.libXrandr
+]; in
+stdenv.mkDerivation rec {
+  pname = "ivpn-ui";
+  version = "3.10.15";
+
+  src = fetchurl {
+    url = "https://repo.ivpn.net/stable/pool/ivpn-ui_${version}_amd64.deb";
+    hash = "sha256-dcPxhn+YQbEn1pNgOL8Qtu274Lsnvnwu6Rsyst75W8M=";
+  };
+
+  nativeBuildInputs = [
+    autoPatchelfHook
+    dpkg
+    makeWrapper
+  ];
+
+  buildInputs = deps;
+
+  dontBuild = true;
+  dontConfigure = true;
+
+  unpackPhase = "dpkg-deb -x $src .";
+
+  runtimeDependencies = [ (lib.getLib systemd) libGL libnotify libappindicator wayland ];
+
+  installPhase = ''
+    runHook preInstall
+    mkdir -p $out/bin $out/share/{ivpn,applications}
+    mv opt/ivpn/ui/* $out/share/ivpn
+    mv usr/share/* $out/share
+    ln -s $out/share/ivpn/bin/ivpn-ui $out/bin
+
+    mv $out/share/ivpn/IVPN.desktop $out/share/applications/IVPN.desktop
+    substituteInPlace $out/share/applications/IVPN.desktop \
+      --replace "/opt/ivpn/ui/bin/ivpn-ui" "$out/bin/ivpn-ui" \
+      --replace "/opt/ivpn/ui/ivpnicon.svg" "$out/share/applications/ivpnicon.svg"
+    runHook postInstall
+  '';
+
+  meta = with lib; {
+    description = "Official IVPN Desktop app";
+    homepage = "https://www.ivpn.net/apps";
+    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ ataraxiasjel ];
+  };
+}

profiles/packages/ivpn/default.nix

@@ -0,0 +1,102 @@
+{ buildGoModule
+, fetchFromGitHub
+, lib
+, wirelesstools
+, makeWrapper
+, wireguard-tools
+, openvpn
+, obfs4
+, iproute2
+, dnscrypt-proxy2
+, iptables
+, gawk
+, util-linux
+}:
+
+builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
+  inherit pname;
+  version = "3.10.15";
+
+  src = fetchFromGitHub {
+    owner = "ivpn";
+    repo = "desktop-app";
+    rev = "v${version}";
+    hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
+  };
+
+  nativeBuildInputs = [ makeWrapper ];
+
+  ldflags = [
+    "-s"
+    "-w"
+    "-X github.com/ivpn/desktop-app/daemon/version._version=${version}"
+    "-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
+  ];
+
+  patches = [
+    ./path.patch
+  ];
+
+  postPatch = ''
+    substituteInPlace daemon/service/platform/platform_linux_release.go \
+      --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\""
+  '';
+
+  postInstall = ''
+    mv $out/bin/{${attrs.modRoot},${pname}}
+    ${lib.optionalString (attrs.modRoot == "daemon") ''
+      install -Dm700 $src/daemon/References/Linux/etc/client.down "$out/etc/client.down"
+      install -Dm700 $src/daemon/References/Linux/etc/client.up "$out/etc/client.up"
+      install -Dm700 $src/daemon/References/Linux/etc/firewall.sh "$out/etc/firewall.sh"
+      install -Dm700 $src/daemon/References/Linux/etc/splittun.sh "$out/etc/splittun.sh"
+      install -Dm600 $src/daemon/References/common/etc/servers.json "$out/etc/servers.json"
+      install -Dm400 $src/daemon/References/common/etc/ca.crt "$out/etc/ca.crt"
+      install -Dm400 $src/daemon/References/common/etc/ta.key "$out/etc/ta.key"
+      install -Dm400 $src/daemon/References/common/etc/dnscrypt-proxy-template.toml "$out/etc/dnscrypt-proxy-template.toml"
+
+      patchShebangs --build $out/etc/firewall.sh
+      patchShebangs --build $out/etc/splittun.sh
+      patchShebangs --build $out/etc/client.down
+      patchShebangs --build $out/etc/client.up
+    ''}
+  '';
+
+  postFixup = lib.optionalString (pname == "ivpn-service") ''
+    wrapProgram "$out/bin/ivpn-service" \
+      --suffix PATH : ${lib.makeBinPath [
+        wireguard-tools
+        openvpn
+        obfs4
+        iproute2
+        dnscrypt-proxy2
+        iptables
+        gawk
+        util-linux
+      ]}
+  '';
+
+  meta = with lib; {
+    description = "Official IVPN Desktop app";
+    homepage = "https://www.ivpn.net/apps";
+    changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
+    license = licenses.gpl3Only;
+    maintainers = with maintainers; [ urandom ataraxiasjel ];
+  };
+})) {
+  ivpn = {
+    modRoot = "cli";
+    vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
+  };
+  ivpn-service = {
+    modRoot = "daemon";
+    vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
+    buildInputs = [
+      wirelesstools
+      wireguard-tools
+      openvpn
+      obfs4
+      iproute2
+      dnscrypt-proxy2
+    ];
+  };
+}

profiles/packages/ivpn/path.patch

@@ -0,0 +1,96 @@
+diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
+index 941a99a7..df821c4d 100644
+--- a/daemon/service/platform/platform.go
++++ b/daemon/service/platform/platform.go
+@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	}
+ 
+ 	// checking file permissions
+-	if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+-	if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+ 
+ 	if len(openvpnUpScript) > 0 {
+ 		if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
+@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
+ 		errors = append(errors, err)
+ 	}
+-	if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
+-		errors = append(errors, err)
+-	}
+ 
+ 	if len(routeCommand) > 0 {
+ 		routeBinary := strings.Split(routeCommand, " ")[0]
+diff --git a/daemon/service/platform/platform_linux.go b/daemon/service/platform/platform_linux.go
+index 0c2d9850..ec99a352 100644
+--- a/daemon/service/platform/platform_linux.go
++++ b/daemon/service/platform/platform_linux.go
+@@ -87,8 +87,16 @@ func GetSnapEnvs() *SnapEnvInfo {
+ 
+ // initialize all constant values (e.g. servicePortFile) which can be used in external projects (IVPN CLI)
+ func doInitConstants() {
+-	openVpnBinaryPath = "/usr/sbin/openvpn"
+-	routeCommand = "/sbin/ip route"
++	if p, err := exec.LookPath("openvpn"); err == nil {
++		if p, err = filepath.Abs(p); err == nil {
++			openVpnBinaryPath = p
++		}
++	}
++	if p, err := exec.LookPath("ip"); err == nil {
++		if p, err = filepath.Abs(p); err == nil {
++			routeCommand = p + " route"
++		}
++	}
+ 
+ 	// check if we are running in snap environment
+ 	if envs := GetSnapEnvs(); envs != nil {
+diff --git a/daemon/service/platform/platform_linux_release.go b/daemon/service/platform/platform_linux_release.go
+index 8b60c46c..cd76f1c9 100644
+--- a/daemon/service/platform/platform_linux_release.go
++++ b/daemon/service/platform/platform_linux_release.go
+@@ -27,6 +27,8 @@ package platform
+ 
+ import (
+ 	"path"
++	"os/exec"
++	"path/filepath"
+ )
+ 
+ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
+@@ -50,12 +52,28 @@ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
+ 	openvpnDownScript = path.Join(installDir, "etc/client.down")
+ 	serversFileBundled = path.Join(installDir, "etc/servers.json")
+ 
+-	obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")
++	if p, err := exec.LookPath("obfs4proxy"); err == nil {
++		if p, err = filepath.Abs(p); err == nil {
++			obfsproxyStartScript = p
++		}
++	}
+ 
+-	wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")
+-	wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")
++	if p, err := exec.LookPath("wg-quick"); err == nil {
++		if p, err = filepath.Abs(p); err == nil {
++			wgBinaryPath = p
++		}
++	}
++	if p, err := exec.LookPath("wg"); err == nil {
++		if p, err = filepath.Abs(p); err == nil {
++			wgToolBinaryPath = p
++		}
++	}
+ 
+-	dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")
++	if p, err := exec.LookPath("dnscrypt-proxy"); err == nil {
++		if p, err = filepath.Abs(p); err == nil {
++			dnscryptproxyBinPath = p
++		}
++	}
+ 	dnscryptproxyConfigTemplate = path.Join(installDir, "etc/dnscrypt-proxy-template.toml")
+ 	dnscryptproxyConfig = path.Join(tmpDir, "dnscrypt-proxy.toml")
+ 

profiles/vpn.nix

@@ -1,6 +1,7 @@
 { pkgs, lib, config, ... }:
 let
   isMullvad = config.deviceSpecific.vpn.mullvad.enable;
+  isIVPN = config.deviceSpecific.vpn.ivpn.enable;
   isTailscale = config.deviceSpecific.vpn.tailscale.enable;
 in {
   config = lib.mkMerge [
@@ -16,6 +17,14 @@ in {
       persist.cache.directories = [ "/var/cache/mullvad-vpn" ];
     })
 
+    (lib.mkIf isIVPN {
+      services.ivpn.enable = true;
+      home-manager.users.${config.mainuser}.home.packages = [ pkgs.ivpn-ui ];
+      persist.state.directories = [ "/etc/opt/ivpn" ];
+      # persist.state.homeFiles = [ ".config/IVPN/ivpn-settings.json" ];
+      persist.state.homeDirectories = [ ".config/IVPN" ];
+    })
+
     (lib.mkIf isTailscale {
       services.tailscale = {
         enable = true;