AtaraxiaDev/nixos-config
1
0
Fork 0
Code Issues Pull Requests Projects Releases Wiki Activity
nixos-config/patches/ivpn.patch

339 lines
12 KiB
Diff
Raw Blame History

From 09ad5a699b7652f600ec97a4393b220e1d586b34 Mon Sep 17 00:00:00 2001
From: Dmitriy Kholkin <ataraxiadev@ataraxiadev.com>
Date: Sun, 16 Apr 2023 21:16:53 +0300
Subject: [PATCH 1/2] ivpn{,-service}: 3.10.0 -> 3.10.15, fix packaging.
---
pkgs/tools/networking/ivpn/binary-paths.patch | 125 ++++++++++++++++++
pkgs/tools/networking/ivpn/default.nix | 61 ++++++++-
2 files changed, 181 insertions(+), 5 deletions(-)
create mode 100644 pkgs/tools/networking/ivpn/binary-paths.patch
diff --git a/pkgs/tools/networking/ivpn/binary-paths.patch b/pkgs/tools/networking/ivpn/binary-paths.patch
new file mode 100644
index 00000000000..76c75de06b7
--- /dev/null
+++ b/pkgs/tools/networking/ivpn/binary-paths.patch
@@ -0,0 +1,125 @@
+diff --git a/daemon/netinfo/netinfo_linux.go b/daemon/netinfo/netinfo_linux.go
+index 2c953a6d..084aeba0 100644
+--- a/daemon/netinfo/netinfo_linux.go
++++ b/daemon/netinfo/netinfo_linux.go
+@@ -27,6 +27,8 @@ import (
+ "net"
+ "regexp"
+ "strconv"
++ "os/exec"
++ "path/filepath"
+
+ "github.com/ivpn/desktop-app/daemon/shell"
+ )
+@@ -66,7 +68,14 @@ func doDefaultGatewayIP() (defGatewayIP net.IP, err error) {
+ }
+ }
+
+- retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")
++ ipCommand := ""
++ if p, err := exec.LookPath("ip"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ ipCommand = p
++ }
++ }
++
++ retErr := shell.ExecAndProcessOutput(log, outParse, "", ipCommand, "route")
+
+ if retErr == nil {
+ if defGatewayIP == nil {
+diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
+index 941a99a7..df821c4d 100644
+--- a/daemon/service/platform/platform.go
++++ b/daemon/service/platform/platform.go
+@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ }
+
+ // checking file permissions
+- if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
+- errors = append(errors, err)
+- }
+- if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
+- errors = append(errors, err)
+- }
+
+ if len(openvpnUpScript) > 0 {
+ if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
+@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
+ errors = append(errors, err)
+ }
+- if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
+- errors = append(errors, err)
+- }
+
+ if len(routeCommand) > 0 {
+ routeBinary := strings.Split(routeCommand, " ")[0]
+diff --git a/daemon/service/platform/platform_linux.go b/daemon/service/platform/platform_linux.go
+index 0c2d9850..ec99a352 100644
+--- a/daemon/service/platform/platform_linux.go
++++ b/daemon/service/platform/platform_linux.go
+@@ -87,8 +87,16 @@ func GetSnapEnvs() *SnapEnvInfo {
+
+ // initialize all constant values (e.g. servicePortFile) which can be used in external projects (IVPN CLI)
+ func doInitConstants() {
+- openVpnBinaryPath = "/usr/sbin/openvpn"
+- routeCommand = "/sbin/ip route"
++ if p, err := exec.LookPath("openvpn"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ openVpnBinaryPath = p
++ }
++ }
++ if p, err := exec.LookPath("ip"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ routeCommand = p + " route"
++ }
++ }
+
+ // check if we are running in snap environment
+ if envs := GetSnapEnvs(); envs != nil {
+diff --git a/daemon/service/platform/platform_linux_release.go b/daemon/service/platform/platform_linux_release.go
+index 8b60c46c..cd76f1c9 100644
+--- a/daemon/service/platform/platform_linux_release.go
++++ b/daemon/service/platform/platform_linux_release.go
+@@ -27,6 +27,8 @@ package platform
+
+ import (
+ "path"
++ "os/exec"
++ "path/filepath"
+ )
+
+ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
+@@ -50,12 +52,28 @@ func doOsInitForBuild() (warnings []string, errors []error, logInfo []string) {
+ openvpnDownScript = path.Join(installDir, "etc/client.down")
+ serversFileBundled = path.Join(installDir, "etc/servers.json")
+
+- obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")
++ if p, err := exec.LookPath("obfs4proxy"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ obfsproxyStartScript = p
++ }
++ }
+
+- wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")
+- wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")
++ if p, err := exec.LookPath("wg-quick"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ wgBinaryPath = p
++ }
++ }
++ if p, err := exec.LookPath("wg"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ wgToolBinaryPath = p
++ }
++ }
+
+- dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")
++ if p, err := exec.LookPath("dnscrypt-proxy"); err == nil {
++ if p, err = filepath.Abs(p); err == nil {
++ dnscryptproxyBinPath = p
++ }
++ }
+ dnscryptproxyConfigTemplate = path.Join(installDir, "etc/dnscrypt-proxy-template.toml")
+ dnscryptproxyConfig = path.Join(tmpDir, "dnscrypt-proxy.toml")
+
diff --git a/pkgs/tools/networking/ivpn/default.nix b/pkgs/tools/networking/ivpn/default.nix
index 7a475478a16..8ea80457ca8 100644
--- a/pkgs/tools/networking/ivpn/default.nix
+++ b/pkgs/tools/networking/ivpn/default.nix
@@ -2,17 +2,26 @@
, fetchFromGitHub
, lib
, wirelesstools
+, makeWrapper
+, wireguard-tools
+, openvpn
+, obfs4
+, iproute2
+, dnscrypt-proxy2
+, iptables
+, gawk
+, util-linux
}:
builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
inherit pname;
- version = "3.10.0";
+ version = "3.10.15";
src = fetchFromGitHub {
owner = "ivpn";
repo = "desktop-app";
rev = "v${version}";
- hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y=";
+ hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
};
ldflags = [
@@ -31,16 +40,58 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
homepage = "https://www.ivpn.net/apps";
changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
license = licenses.gpl3Only;
- maintainers = with maintainers; [ urandom ];
+ maintainers = with maintainers; [ urandom ataraxiasjel ];
};
})) {
ivpn = {
modRoot = "cli";
- vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY=";
+ vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
};
ivpn-service = {
modRoot = "daemon";
vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
- buildInputs = [ wirelesstools ];
+ nativeBuildInputs = [ makeWrapper ];
+ buildInputs = [
+ wirelesstools
+ wireguard-tools
+ openvpn
+ obfs4
+ iproute2
+ dnscrypt-proxy2
+ ];
+
+ patches = [ ./binary-paths.patch ];
+ postPatch = ''
+ substituteInPlace daemon/service/platform/platform_linux_release.go \
+ --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\""
+ '';
+
+ postFixup = ''
+ install -Dm700 $src/daemon/References/Linux/etc/client.down "$out/etc/client.down"
+ install -Dm700 $src/daemon/References/Linux/etc/client.up "$out/etc/client.up"
+ install -Dm700 $src/daemon/References/Linux/etc/firewall.sh "$out/etc/firewall.sh"
+ install -Dm700 $src/daemon/References/Linux/etc/splittun.sh "$out/etc/splittun.sh"
+ install -Dm600 $src/daemon/References/common/etc/servers.json "$out/etc/servers.json"
+ install -Dm400 $src/daemon/References/common/etc/ca.crt "$out/etc/ca.crt"
+ install -Dm400 $src/daemon/References/common/etc/ta.key "$out/etc/ta.key"
+ install -Dm400 $src/daemon/References/common/etc/dnscrypt-proxy-template.toml "$out/etc/dnscrypt-proxy-template.toml"
+
+ patchShebangs --build $out/etc/firewall.sh
+ patchShebangs --build $out/etc/splittun.sh
+ patchShebangs --build $out/etc/client.down
+ patchShebangs --build $out/etc/client.up
+
+ wrapProgram "$out/bin/ivpn-service" \
+ --suffix PATH : ${lib.makeBinPath [
+ wireguard-tools
+ openvpn
+ obfs4
+ iproute2
+ dnscrypt-proxy2
+ iptables
+ gawk
+ util-linux
+ ]}
+ '';
};
}
--
2.39.2
From 6b70e841c49fa85a771577b5751f9aa3fbb3ef0c Mon Sep 17 00:00:00 2001
From: Dmitriy Kholkin <ataraxiadev@ataraxiadev.com>
Date: Sun, 16 Apr 2023 21:17:04 +0300
Subject: [PATCH 2/2] nixos/ivpn: init
---
.../manual/release-notes/rl-2305.section.md | 2 +
nixos/modules/module-list.nix | 1 +
nixos/modules/services/networking/ivpn.nix | 51 +++++++++++++++++++
3 files changed, 54 insertions(+)
create mode 100644 nixos/modules/services/networking/ivpn.nix
diff --git a/nixos/doc/manual/release-notes/rl-2305.section.md b/nixos/doc/manual/release-notes/rl-2305.section.md
index 8fa38931396..7ec3b074ed1 100644
--- a/nixos/doc/manual/release-notes/rl-2305.section.md
+++ b/nixos/doc/manual/release-notes/rl-2305.section.md
@@ -111,6 +111,8 @@ In addition to numerous new and upgraded packages, this release has the followin
- [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.
+- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).
+
## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
<!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->
diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
index e0e50295abb..29ed59b9963 100644
--- a/nixos/modules/module-list.nix
+++ b/nixos/modules/module-list.nix
@@ -883,6 +883,7 @@
./services/networking/iscsi/initiator.nix
./services/networking/iscsi/root-initiator.nix
./services/networking/iscsi/target.nix
+ ./services/networking/ivpn.nix
./services/networking/iwd.nix
./services/networking/jibri/default.nix
./services/networking/jicofo.nix
diff --git a/nixos/modules/services/networking/ivpn.nix b/nixos/modules/services/networking/ivpn.nix
new file mode 100644
index 00000000000..6df630c1f19
--- /dev/null
+++ b/nixos/modules/services/networking/ivpn.nix
@@ -0,0 +1,51 @@
+{ config, lib, pkgs, ... }:
+let
+ cfg = config.services.ivpn;
+in
+with lib;
+{
+ options.services.ivpn = {
+ enable = mkOption {
+ type = types.bool;
+ default = false;
+ description = lib.mdDoc ''
+ This option enables iVPN daemon.
+ This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
+ '';
+ };
+ };
+
+ config = mkIf cfg.enable {
+ boot.kernelModules = [ "tun" ];
+
+ environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
+
+ # iVPN writes to /etc/iproute2/rt_tables
+ networking.iproute2.enable = true;
+ networking.firewall.checkReversePath = "loose";
+
+ systemd.services.ivpn-service = {
+ description = "iVPN daemon";
+ wantedBy = [ "multi-user.target" ];
+ wants = [ "network.target" ];
+ after = [
+ "network-online.target"
+ "NetworkManager.service"
+ "systemd-resolved.service"
+ ];
+ path = [
+ # Needed for mount
+ "/run/wrappers"
+ ];
+ startLimitBurst = 5;
+ startLimitIntervalSec = 20;
+ serviceConfig = {
+ ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
+ Restart = "always";
+ RestartSec = 1;
+ };
+ };
+ };
+
+ meta.maintainers = with maintainers; [ ataraxiasjel ];
+}
--
2.39.2
Reference in New Issue View Git Blame Copy Permalink