AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity

use ivpn from nixpkgs

Browse Source
This commit is contained in:
Dmitriy Kholkin 2023-04-16 22:40:20 +03:00
parent ae1495e153
commit 59d82ca5a9
10 changed files with 535 additions and 331 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

2
flake.nix
View File

@ -105,6 +105,8 @@
"gitea-208605.patch"
"waydroid-1.4.0.patch"
"bitwarden-pr224092.patch"
"ivpn.patch"
"ivpn-ui.patch"
];
channelsConfig = { allowUnfree = true; };
channels.unstable.input = nixpkgs;

47
modules/ivpn.nix
View File

@ -1,47 +0,0 @@
{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.ivpn;
in {
options.services.ivpn = {
enable = mkOption {
type = types.bool;
default = false;
description = lib.mdDoc ''
This option enables iVPN daemon.
'';
};
};
config = lib.mkIf cfg.enable {
boot.kernelModules = [ "tun" ];
environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
# iVPN writes to /etc/iproute2/rt_tables
networking.iproute2.enable = true;
networking.firewall.checkReversePath = "loose";
systemd.services.ivpn-service = {
description = "iVPN daemon";
wantedBy = [ "multi-user.target" ];
wants = [ "network.target" ];
after = [
"network-online.target"
"NetworkManager.service"
"systemd-resolved.service"
];
path = [
# Needed for mount
"/run/wrappers"
];
startLimitBurst = 5;
startLimitIntervalSec = 20;
serviceConfig = {
ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
Restart = "always";
RestartSec = 1;
};
};
};
}

164
patches/ivpn-ui.patch Normal file
View File

@ -0,0 +1,164 @@
diff --git a/pkgs/tools/networking/ivpn-ui/binary-paths.patch b/pkgs/tools/networking/ivpn-ui/binary-paths.patch
new file mode 100644
index 00000000000..1859f67bb3a
--- /dev/null
+++ b/pkgs/tools/networking/ivpn-ui/binary-paths.patch
@@ -0,0 +1,46 @@
+diff --git a/src/daemon-client/index.js b/src/daemon-client/index.js
+index ef197a1f..382ba4a3 100644
+--- a/src/daemon-client/index.js
++++ b/src/daemon-client/index.js
+@@ -1585,7 +1585,9 @@ async function SplitTunnelAddApp(execCmd, funcShowMessageBox) {
+ if (ParanoidModeSecret) {
+ eaaArgs = `-eaa_hash '${ParanoidModeSecret}' `;
+ }
+- let shellCommandToRun = `/usr/bin/ivpn exclude ${eaaArgs}${execCmd}`;
++ var which = require("which");
++ let pathToBinary = which.sync('ivpn');
++ let shellCommandToRun = `${pathToBinary} exclude ${eaaArgs}${execCmd}`;
+
+ var exec = require("child_process").exec;
+ let child = exec(shellCommandToRun, {
+@@ -1660,8 +1662,11 @@ async function GetInstalledApps() {
+ try {
+ var execSync = require("child_process").execSync;
+ let envs = { ...process.env, XDG_CURRENT_DESKTOP: XDG_CURRENT_DESKTOP };
++ var which = require("which");
++ let pathToBinary = which.sync('gsettings');
++ let execCmd = `${pathToBinary} get org.gnome.desktop.interface icon-theme`;
+ iconsThemeName = execSync(
+- "/usr/bin/gsettings get org.gnome.desktop.interface icon-theme",
++ execCmd,
+ { env: envs }
+ )
+ .toString()
+diff --git a/src/helpers/main_platform.js b/src/helpers/main_platform.js
+index 76465810..bb20a162 100644
+--- a/src/helpers/main_platform.js
++++ b/src/helpers/main_platform.js
+@@ -58,8 +58,11 @@ export async function GetOpenSSLBinaryPath() {
+ switch (Platform()) {
+ case PlatformEnum.macOS:
+ return "/usr/bin/openssl";
+- case PlatformEnum.Linux:
+- return "/usr/bin/openssl";
++ case PlatformEnum.Linux: {
++ var which = require("which");
++ let pathToBinary = which.sync('openssl');
++ return pathToBinary;
++ }
+ case PlatformEnum.Windows: {
+ if (os.arch() === "x64") {
+ let dir = await winInstallFolder();
diff --git a/pkgs/tools/networking/ivpn-ui/default.nix b/pkgs/tools/networking/ivpn-ui/default.nix
new file mode 100644
index 00000000000..805b7bdc31b
--- /dev/null
+++ b/pkgs/tools/networking/ivpn-ui/default.nix
@@ -0,0 +1,93 @@
+{ lib
+, buildNpmPackage
+, fetchFromGitHub
+, nodejs-16_x
+, electron_21
+, jq
+, makeWrapper
+, moreutils
+, makeDesktopItem
+}:
+
+let
+ buildNpmPackage' = buildNpmPackage.override { nodejs = nodejs-16_x; };
+ electron = electron_21;
+
+ desktopItem = makeDesktopItem {
+ name = "IVPN";
+ desktopName = "IVPN";
+ comment = "UI interface for IVPN";
+ genericName = "VPN client";
+ exec = "ivpn-ui";
+ icon = "ivpnicon.svg";
+ type = "Application";
+ startupNotify = true;
+ categories = [ "Network" ];
+ };
+in buildNpmPackage' rec {
+ pname = "ivpn-ui";
+ version = "3.10.14";
+
+ src = fetchFromGitHub {
+ owner = "ivpn";
+ repo = "desktop-app";
+ rev = "v${version}";
+ hash = "sha256-zHBjAEVHjnHMuUutwQQCCcZ7+Fz3C4GCAV3/jgZgwhM=";
+ };
+
+ env = {
+ ELECTRON_OVERRIDE_DIST_PATH = "${electron}/bin";
+ ELECTRON_CACHE = ".cache/electron";
+ ELECTRON_SKIP_BINARY_DOWNLOAD = "1";
+ NODE_OPTIONS = "--openssl-legacy-provider";
+ };
+
+ npmBuildScript = "electron:build";
+ npmDepsHash = "sha256-U7Jurq7Dv9oRZushf8yeHuqe3pKTBJ/9hpS/iQzIYkI=";
+
+ sourceRoot = "source/ui";
+
+ nativeBuildInputs = [
+ jq
+ makeWrapper
+ ];
+
+ patches = [ ./binary-paths.patch ];
+
+ # electron-builder attempts to download Electron frow web,
+ # so we need to provide a zipped version of Electron.
+ # The "patch" version of Electron that we provide may differ from the one
+ # in the package-lock.json file, but it should not cause any problems.
+ preBuild = ''
+ mkdir -p .cache/electron
+ ln -sf ${electron.src} .cache/electron/electron-v$(jq -r '.devDependencies.electron' package.json)-linux-x64.zip
+ '';
+
+ installPhase = ''
+ runHook preInstall
+
+ mkdir -p $out/bin $out/opt/ivpn-ui $out/share/applications $out/usr/share/pixmaps
+
+ pushd dist_electron/linux-unpacked
+ cp -r locales resources $out/opt/ivpn-ui
+ cp ivpn-ui $out/bin
+ popd
+
+ cp ${desktopItem}/share/applications/* $out/share/applications
+ cp References/Linux/ui/ivpnicon.svg $out/usr/share/pixmaps
+
+ makeWrapper '${electron}/bin/electron' "$out/bin/ivpn-ui" \
+ --add-flags $out/opt/ivpn-ui/resources/app.asar \
+ --add-flags "\''${NIXOS_OZONE_WL:+\''${WAYLAND_DISPLAY:+--ozone-platform-hint=auto --enable-features=WaylandWindowDecorations}}"
+
+ runHook postInstall
+ '';
+
+ meta = with lib; {
+ description = "Official IVPN Desktop app";
+ homepage = "https://www.ivpn.net/apps";
+ changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
+ license = licenses.gpl3Only;
+ maintainers = with maintainers; [ ataraxiasjel ];
+ };
+}
diff --git a/pkgs/top-level/all-packages.nix b/pkgs/top-level/all-packages.nix
index 8ad6bb2cca8..8d45a5ed9b5 100644
--- a/pkgs/top-level/all-packages.nix
+++ b/pkgs/top-level/all-packages.nix
@@ -1554,6 +1554,8 @@ with pkgs;
inherit (callPackage ../tools/networking/ivpn/default.nix {}) ivpn ivpn-service;
+ ivpn-ui = callPackage ../tools/networking/ivpn-ui { };
+
jobber = callPackage ../tools/system/jobber { };
kanata = callPackage ../tools/system/kanata { };

338
patches/ivpn.patch Normal file
View File

@ -0,0 +1,338 @@
From 09ad5a699b7652f600ec97a4393b220e1d586b34 Mon Sep 17 00:00:00 2001
From: Dmitriy Kholkin <ataraxiadev@ataraxiadev.com>
Date: Sun, 16 Apr 2023 21:16:53 +0300
Subject: [PATCH 1/2] ivpn{,-service}: 3.10.0 -> 3.10.15, fix packaging.
---
pkgs/tools/networking/ivpn/binary-paths.patch | 125 ++++++++++++++++++
pkgs/tools/networking/ivpn/default.nix | 61 ++++++++-
2 files changed, 181 insertions(+), 5 deletions(-)
create mode 100644 pkgs/tools/networking/ivpn/binary-paths.patch
diff --git a/pkgs/tools/networking/ivpn/binary-paths.patch b/pkgs/tools/networking/ivpn/binary-paths.patch
new file mode 100644
index 00000000000..76c75de06b7
--- /dev/null
+++ b/pkgs/tools/networking/ivpn/binary-paths.patch
@@ -0,0 +1,125 @@
+diff --git a/daemon/netinfo/netinfo_linux.go b/daemon/netinfo/netinfo_linux.go
+index 2c953a6d..084aeba0 100644
+--- a/daemon/netinfo/netinfo_linux.go
++++ b/daemon/netinfo/netinfo_linux.go
+@@ -27,6 +27,8 @@ import (
+ "net"
+ "regexp"
+ "strconv"
++ "os/exec"
++ "path/filepath"
+
+ "github.com/ivpn/desktop-app/daemon/shell"
+ )
+@@ -66,7 +68,14 @@ func doDefaultGatewayIP() (defGatewayIP net.IP, err error) {
+ }
+ }
+
+- retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")
++ ipCommand := ""
++ if p, err := exec.LookPath("ip"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ ipCommand = p
++ }
++ }
++
++ retErr := shell.ExecAndProcessOutput(log, outParse, "", ipCommand, "route")
+
+ if retErr == nil {
+ if defGatewayIP == nil {
+diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
+index 941a99a7..df821c4d 100644
+--- a/daemon/service/platform/platform.go
++++ b/daemon/service/platform/platform.go
+@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ }
+
+ // checking file permissions
+- if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
+- errors = append(errors, err)
+- }
+- if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
+- errors = append(errors, err)
+- }
+
+ if len(openvpnUpScript) > 0 {
+ if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
+@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
+ errors = append(errors, err)
+ }
+- if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
+- errors = append(errors, err)
+- }
+
+ if len(routeCommand) > 0 {
+ routeBinary := strings.Split(routeCommand, " ")[0]
+diff --git a/daemon/service/platform/platform_linux.go b/daemon/service/platform/platform_linux.go
+index 0c2d9850..ec99a352 100644
+--- a/daemon/service/platform/platform_linux.go
++++ b/daemon/service/platform/platform_linux.go
+@@ -87,8 +87,16 @@ func GetSnapEnvs() *SnapEnvInfo {
+
+ // initialize all constant values (e.g. servicePortFile) which can be used in external projects (IVPN CLI)
+ func doInitConstants() {
+- openVpnBinaryPath = "/usr/sbin/openvpn"
+- routeCommand = "/sbin/ip route"
++ if p, err := exec.LookPath("openvpn"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ openVpnBinaryPath = p
++ }
++ }
++ if p, err := exec.LookPath("ip"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ routeCommand = p + " route"
++ }
++ }
+
+ // check if we are running in snap environment
+ if envs := GetSnapEnvs(); envs != nil {
+diff --git a/daemon/service/platform/platform_linux_release.go b/daemon/service/platform/platform_linux_release.go
+index 8b60c46c..cd76f1c9 100644
+--- a/daemon/service/platform/platform_linux_release.go
++++ b/daemon/service/platform/platform_linux_release.go
+@@ -27,6 +27,8 @@ package platform
+
+ import (
+ "path"
++ "os/exec"
++ "path/filepath"
+ )
+
+ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
+@@ -50,12 +52,28 @@ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
+ openvpnDownScript = path.Join(installDir, "etc/client.down")
+ serversFileBundled = path.Join(installDir, "etc/servers.json")
+
+- obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")
++ if p, err := exec.LookPath("obfs4proxy"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ obfsproxyStartScript = p
++ }
++ }
+
+- wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")
+- wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")
++ if p, err := exec.LookPath("wg-quick"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ wgBinaryPath = p
++ }
++ }
++ if p, err := exec.LookPath("wg"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ wgToolBinaryPath = p
++ }
++ }
+
+- dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")
++ if p, err := exec.LookPath("dnscrypt-proxy"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ dnscryptproxyBinPath = p
++ }
++ }
+ dnscryptproxyConfigTemplate = path.Join(installDir, "etc/dnscrypt-proxy-template.toml")
+ dnscryptproxyConfig = path.Join(tmpDir, "dnscrypt-proxy.toml")
+
diff --git a/pkgs/tools/networking/ivpn/default.nix b/pkgs/tools/networking/ivpn/default.nix
index 7a475478a16..8ea80457ca8 100644
--- a/pkgs/tools/networking/ivpn/default.nix
+++ b/pkgs/tools/networking/ivpn/default.nix
@@ -2,17 +2,26 @@
, fetchFromGitHub
, lib
, wirelesstools
+, makeWrapper
+, wireguard-tools
+, openvpn
+, obfs4
+, iproute2
+, dnscrypt-proxy2
+, iptables
+, gawk
+, util-linux
}:
builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
inherit pname;
- version = "3.10.0";
+ version = "3.10.15";
src = fetchFromGitHub {
owner = "ivpn";
repo = "desktop-app";
rev = "v${version}";
- hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y=";
+ hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
};
ldflags = [
@@ -31,16 +40,58 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
homepage = "https://www.ivpn.net/apps";
changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
license = licenses.gpl3Only;
- maintainers = with maintainers; [ urandom ];
+ maintainers = with maintainers; [ urandom ataraxiasjel ];
};
})) {
ivpn = {
modRoot = "cli";
- vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY=";
+ vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
};
ivpn-service = {
modRoot = "daemon";
vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
- buildInputs = [ wirelesstools ];
+ nativeBuildInputs = [ makeWrapper ];
+ buildInputs = [
+ wirelesstools
+ wireguard-tools
+ openvpn
+ obfs4
+ iproute2
+ dnscrypt-proxy2
+ ];
+
+ patches = [ ./binary-paths.patch ];
+ postPatch = ''
+ substituteInPlace daemon/service/platform/platform_linux_release.go \
+ --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\""
+ '';
+
+ postFixup = ''
+ install -Dm700 $src/daemon/References/Linux/etc/client.down "$out/etc/client.down"
+ install -Dm700 $src/daemon/References/Linux/etc/client.up "$out/etc/client.up"
+ install -Dm700 $src/daemon/References/Linux/etc/firewall.sh "$out/etc/firewall.sh"
+ install -Dm700 $src/daemon/References/Linux/etc/splittun.sh "$out/etc/splittun.sh"
+ install -Dm600 $src/daemon/References/common/etc/servers.json "$out/etc/servers.json"
+ install -Dm400 $src/daemon/References/common/etc/ca.crt "$out/etc/ca.crt"
+ install -Dm400 $src/daemon/References/common/etc/ta.key "$out/etc/ta.key"
+ install -Dm400 $src/daemon/References/common/etc/dnscrypt-proxy-template.toml "$out/etc/dnscrypt-proxy-template.toml"
+
+ patchShebangs --build $out/etc/firewall.sh
+ patchShebangs --build $out/etc/splittun.sh
+ patchShebangs --build $out/etc/client.down
+ patchShebangs --build $out/etc/client.up
+
+ wrapProgram "$out/bin/ivpn-service" \
+ --suffix PATH : ${lib.makeBinPath [
+ wireguard-tools
+ openvpn
+ obfs4
+ iproute2
+ dnscrypt-proxy2
+ iptables
+ gawk
+ util-linux
+ ]}
+ '';
};
}
--
2.39.2
From 6b70e841c49fa85a771577b5751f9aa3fbb3ef0c Mon Sep 17 00:00:00 2001
From: Dmitriy Kholkin <ataraxiadev@ataraxiadev.com>
Date: Sun, 16 Apr 2023 21:17:04 +0300
Subject: [PATCH 2/2] nixos/ivpn: init
---
.../manual/release-notes/rl-2305.section.md | 2 +
nixos/modules/module-list.nix | 1 +
nixos/modules/services/networking/ivpn.nix | 51 +++++++++++++++++++
3 files changed, 54 insertions(+)
create mode 100644 nixos/modules/services/networking/ivpn.nix
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 8fa38931396..7ec3b074ed1 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -111,6 +111,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.
+- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).
+
## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e0e50295abb..29ed59b9963 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -883,6 +883,7 @@
./services/networking/iscsi/initiator.nix
./services/networking/iscsi/root-initiator.nix
./services/networking/iscsi/target.nix
+ ./services/networking/ivpn.nix
./services/networking/iwd.nix
./services/networking/jibri/default.nix
./services/networking/jicofo.nix
diff --git a/nixos/modules/services/networking/ivpn.nix b/nixos/modules/services/networking/ivpn.nix
new file mode 100644
index 00000000000..6df630c1f19
--- /dev/null
+++ b/nixos/modules/services/networking/ivpn.nix
@@ -0,0 +1,51 @@
+{ config, lib, pkgs, ... }:
+let
+ cfg = config.services.ivpn;
+in
+with lib;
+{
+ options.services.ivpn = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = lib.mdDoc ''
+ This option enables iVPN daemon.
+ This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
+ '';
+ };
+ };
+
+ config = mkIf cfg.enable {
+ boot.kernelModules = [ "tun" ];
+
+ environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
+
+ # iVPN writes to /etc/iproute2/rt_tables
+ networking.iproute2.enable = true;
+ networking.firewall.checkReversePath = "loose";
+
+ systemd.services.ivpn-service = {
+ description = "iVPN daemon";
+ wantedBy = [ "multi-user.target" ];
+ wants = [ "network.target" ];
+ after = [
+ "network-online.target"
+ "NetworkManager.service"
+ "systemd-resolved.service"
+ ];
+ path = [
+ # Needed for mount
+ "/run/wrappers"
+ ];
+ startLimitBurst = 5;
+ startLimitIntervalSec = 20;
+ serviceConfig = {
+ ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
+ Restart = "always";
+ RestartSec = 1;
+ };
+ };
+ };
+
+ meta.maintainers = with maintainers; [ ataraxiasjel ];
+}
--
2.39.2

30
patches/waydroid-1.4.0.patch
View File

@ -1,5 +1,14 @@
From 8edb79386dc347ed5ca7715b8bbf603519c4c870 Mon Sep 17 00:00:00 2001
From: Dmitriy Kholkin <ataraxiadev@ataraxiadev.com>
Date: Fri, 3 Mar 2023 02:52:20 +0300
Subject: [PATCH] waydroid: 1.3.4 -> 1.4.0
---
pkgs/os-specific/linux/waydroid/default.nix | 10 ++++------
1 file changed, 4 insertions(+), 6 deletions(-)
diff --git a/pkgs/os-specific/linux/waydroid/default.nix b/pkgs/os-specific/linux/waydroid/default.nix
index d01759e8ed6..8f15f1a2222 100644
index d01759e8ed6..ca02af0e40e 100644
--- a/pkgs/os-specific/linux/waydroid/default.nix
+++ b/pkgs/os-specific/linux/waydroid/default.nix
@@ -19,14 +19,14 @@
@ -35,3 +44,22 @@ index d01759e8ed6..8f15f1a2222 100644
python3Packages.gbinder-python
python3Packages.pygobject3
python3Packages.pyclip
@@ -70,15 +72,11 @@ python3Packages.buildPythonApplication rec {
kmod
lxc
util-linux
- which
xclip
]}"
substituteInPlace $out/lib/waydroid/tools/helpers/*.py \
--replace '"sh"' '"${runtimeShell}"'
-
- substituteInPlace $out/share/applications/*.desktop \
- --replace "/usr" "$out"
'';
meta = with lib; {
--
2.39.2

2
profiles/overlay.nix
View File

@ -51,8 +51,6 @@ with lib; {
nixFlakes = final.nix;
cassowary-py = inputs.cassowary.packages.${system}.cassowary;
inherit (prev.callPackage ./packages/ivpn/default.nix {}) ivpn ivpn-service;
ivpn-ui = prev.callPackage ./packages/ivpn-ui/default.nix { };
pass-secret-service = prev.pass-secret-service.overrideAttrs (_: {
installCheckPhase = null;

83
profiles/packages/ivpn-ui/default.nix
View File

@ -1,83 +0,0 @@
{ stdenv, lib, fetchurl, dpkg, autoPatchelfHook, makeWrapper
, alsa-lib, at-spi2-atk, at-spi2-core, atk, cairo
, cups, dbus, expat, ffmpeg, gdk-pixbuf, glib
, gtk3, libappindicator, libdrm, libGL, libnotify, libxkbcommon
, mesa, nspr, nss, pango, systemd, xorg, wayland
}:
let deps = [
alsa-lib
at-spi2-atk
at-spi2-core
atk
cairo
cups
dbus
expat
ffmpeg
gdk-pixbuf
glib
gtk3
libappindicator
libdrm
libnotify
libxkbcommon
mesa
nspr
nss
pango
systemd
xorg.libX11
xorg.libxcb
xorg.libXcomposite
xorg.libXdamage
xorg.libXext
xorg.libXfixes
xorg.libXrandr
]; in
stdenv.mkDerivation rec {
pname = "ivpn-ui";
version = "3.10.15";
src = fetchurl {
url = "https://repo.ivpn.net/stable/pool/ivpn-ui_${version}_amd64.deb";
hash = "sha256-dcPxhn+YQbEn1pNgOL8Qtu274Lsnvnwu6Rsyst75W8M=";
};
nativeBuildInputs = [
autoPatchelfHook
dpkg
makeWrapper
];
buildInputs = deps;
dontBuild = true;
dontConfigure = true;
unpackPhase = "dpkg-deb -x $src .";
runtimeDependencies = [ (lib.getLib systemd) libGL libnotify libappindicator wayland ];
installPhase = ''
runHook preInstall
mkdir -p $out/bin $out/share/{ivpn,applications}
mv opt/ivpn/ui/* $out/share/ivpn
mv usr/share/* $out/share
ln -s $out/share/ivpn/bin/ivpn-ui $out/bin
mv $out/share/ivpn/IVPN.desktop $out/share/applications/IVPN.desktop
substituteInPlace $out/share/applications/IVPN.desktop \
--replace "/opt/ivpn/ui/bin/ivpn-ui" "$out/bin/ivpn-ui" \
--replace "/opt/ivpn/ui/ivpnicon.svg" "$out/share/applications/ivpnicon.svg"
runHook postInstall
'';
meta = with lib; {
description = "Official IVPN Desktop app";
homepage = "https://www.ivpn.net/apps";
changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
license = licenses.gpl3Only;
maintainers = with maintainers; [ ataraxiasjel ];
};
}

102
profiles/packages/ivpn/default.nix
View File

@ -1,102 +0,0 @@
{ buildGoModule
, fetchFromGitHub
, lib
, wirelesstools
, makeWrapper
, wireguard-tools
, openvpn
, obfs4
, iproute2
, dnscrypt-proxy2
, iptables
, gawk
, util-linux
}:
builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
inherit pname;
version = "3.10.15";
src = fetchFromGitHub {
owner = "ivpn";
repo = "desktop-app";
rev = "v${version}";
hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
};
nativeBuildInputs = [ makeWrapper ];
ldflags = [
"-s"
"-w"
"-X github.com/ivpn/desktop-app/daemon/version._version=${version}"
"-X github.com/ivpn/desktop-app/daemon/version._time=1970-01-01"
];
patches = [
./path.patch
];
postPatch = ''
substituteInPlace daemon/service/platform/platform_linux_release.go \
--replace 'installDir := "/opt/ivpn"' "installDir := \"$out\""
'';
postInstall = ''
mv $out/bin/{${attrs.modRoot},${pname}}
${lib.optionalString (attrs.modRoot == "daemon") ''
install -Dm700 $src/daemon/References/Linux/etc/client.down "$out/etc/client.down"
install -Dm700 $src/daemon/References/Linux/etc/client.up "$out/etc/client.up"
install -Dm700 $src/daemon/References/Linux/etc/firewall.sh "$out/etc/firewall.sh"
install -Dm700 $src/daemon/References/Linux/etc/splittun.sh "$out/etc/splittun.sh"
install -Dm600 $src/daemon/References/common/etc/servers.json "$out/etc/servers.json"
install -Dm400 $src/daemon/References/common/etc/ca.crt "$out/etc/ca.crt"
install -Dm400 $src/daemon/References/common/etc/ta.key "$out/etc/ta.key"
install -Dm400 $src/daemon/References/common/etc/dnscrypt-proxy-template.toml "$out/etc/dnscrypt-proxy-template.toml"
patchShebangs --build $out/etc/firewall.sh
patchShebangs --build $out/etc/splittun.sh
patchShebangs --build $out/etc/client.down
patchShebangs --build $out/etc/client.up
''}
'';
postFixup = lib.optionalString (pname == "ivpn-service") ''
wrapProgram "$out/bin/ivpn-service" \
--suffix PATH : ${lib.makeBinPath [
wireguard-tools
openvpn
obfs4
iproute2
dnscrypt-proxy2
iptables
gawk
util-linux
]}
'';
meta = with lib; {
description = "Official IVPN Desktop app";
homepage = "https://www.ivpn.net/apps";
changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
license = licenses.gpl3Only;
maintainers = with maintainers; [ urandom ataraxiasjel ];
};
})) {
ivpn = {
modRoot = "cli";
vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
};
ivpn-service = {
modRoot = "daemon";
vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
buildInputs = [
wirelesstools
wireguard-tools
openvpn
obfs4
iproute2
dnscrypt-proxy2
];
};
}

96
profiles/packages/ivpn/path.patch
View File

@ -1,96 +0,0 @@
diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
index 941a99a7..df821c4d 100644
--- a/daemon/service/platform/platform.go
+++ b/daemon/service/platform/platform.go
@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
}
// checking file permissions
- if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
- errors = append(errors, err)
- }
- if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
- errors = append(errors, err)
- }
if len(openvpnUpScript) > 0 {
if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
errors = append(errors, err)
}
- if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
- errors = append(errors, err)
- }
if len(routeCommand) > 0 {
routeBinary := strings.Split(routeCommand, " ")[0]
diff --git a/daemon/service/platform/platform_linux.go b/daemon/service/platform/platform_linux.go
index 0c2d9850..ec99a352 100644
--- a/daemon/service/platform/platform_linux.go
+++ b/daemon/service/platform/platform_linux.go
@@ -87,8 +87,16 @@ func GetSnapEnvs() *SnapEnvInfo {
// initialize all constant values (e.g. servicePortFile) which can be used in external projects (IVPN CLI)
func doInitConstants() {
- openVpnBinaryPath = "/usr/sbin/openvpn"
- routeCommand = "/sbin/ip route"
+ if p, err := exec.LookPath("openvpn"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ openVpnBinaryPath = p
+ }
+ }
+ if p, err := exec.LookPath("ip"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ routeCommand = p + " route"
+ }
+ }
// check if we are running in snap environment
if envs := GetSnapEnvs(); envs != nil {
diff --git a/daemon/service/platform/platform_linux_release.go b/daemon/service/platform/platform_linux_release.go
index 8b60c46c..cd76f1c9 100644
--- a/daemon/service/platform/platform_linux_release.go
+++ b/daemon/service/platform/platform_linux_release.go
@@ -27,6 +27,8 @@ package platform
import (
"path"
+ "os/exec"
+ "path/filepath"
)
func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
@@ -50,12 +52,28 @@ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
openvpnDownScript = path.Join(installDir, "etc/client.down")
serversFileBundled = path.Join(installDir, "etc/servers.json")
- obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")
+ if p, err := exec.LookPath("obfs4proxy"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ obfsproxyStartScript = p
+ }
+ }
- wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")
- wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")
+ if p, err := exec.LookPath("wg-quick"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ wgBinaryPath = p
+ }
+ }
+ if p, err := exec.LookPath("wg"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ wgToolBinaryPath = p
+ }
+ }
- dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")
+ if p, err := exec.LookPath("dnscrypt-proxy"); err == nil {
+ if p, err = filepath.Abs(p); err == nil {
+ dnscryptproxyBinPath = p
+ }
+ }
dnscryptproxyConfigTemplate = path.Join(installDir, "etc/dnscrypt-proxy-template.toml")
dnscryptproxyConfig = path.Join(tmpDir, "dnscrypt-proxy.toml")

2
profiles/vpn.nix
View File

@ -20,6 +20,8 @@ in {
(lib.mkIf isIVPN {
services.ivpn.enable = true;
home-manager.users.${config.mainuser}.home.packages = [ pkgs.ivpn-ui ];
startupApplications = [ "${pkgs.ivpn-ui}/bin/ivpn-ui" ];
persist.state.directories = [ "/etc/opt/ivpn" ];
# persist.state.homeFiles = [ ".config/IVPN/ivpn-settings.json" ];
persist.state.homeDirectories = [ ".config/IVPN" ];