123 lines
3.1 KiB
Nix
123 lines
3.1 KiB
Nix
# easyrsa --days=36500 init-pki
|
|
# easyrsa --days=36500 build-ca
|
|
# easyrsa --days=36500 build-server-full <SERVER_NAME> nopass
|
|
# easyrsa --days=36500 build-client-full <CLIENT_NAME> nopass
|
|
# easyrsa gen-crl
|
|
# openssl dhparam -out dh2048.pem 2048
|
|
# Don't forget to set tls hostname on the client to match SERVER_NAME *AND* disable ipv6 ?
|
|
|
|
# easyrsa revoke <CLIENT_NAME>
|
|
# easyrsa gen-crl
|
|
# restart container
|
|
|
|
# SEE: https://github.com/OpenVPN/openvpn/blob/master/sample/sample-config-files/server.conf
|
|
# SRC: https://github.com/TinCanTech/easy-tls
|
|
{
|
|
config,
|
|
container,
|
|
lib,
|
|
pkgs,
|
|
util,
|
|
...
|
|
}: let
|
|
cfg = config.container.module.vpn;
|
|
in {
|
|
options.container.module.vpn = {
|
|
enable = lib.mkEnableOption "the vpn server.";
|
|
address = lib.mkOption {
|
|
default = "10.1.0.23";
|
|
type = lib.types.str;
|
|
};
|
|
port = lib.mkOption {
|
|
default = 22145;
|
|
type = lib.types.int;
|
|
};
|
|
storage = lib.mkOption {
|
|
default = "${config.container.storage}/vpn";
|
|
type = lib.types.str;
|
|
};
|
|
clients = lib.mkOption {
|
|
default = "10.1.1.0/24";
|
|
type = lib.types.str;
|
|
};
|
|
};
|
|
|
|
config = lib.mkIf cfg.enable {
|
|
systemd.tmpfiles.rules = container.mkContainerDir cfg [
|
|
"data"
|
|
];
|
|
|
|
# HACK: I have no idea how to fully manage the container interface via networkd, so just add a route manually.
|
|
systemd.services.vpn-route = util.mkStaticSystemdService {
|
|
enable = true;
|
|
description = "Hack vpn routes on host";
|
|
after = [ "container@vpn.service" ];
|
|
wants = [ "container@vpn.service" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
serviceConfig = {
|
|
Type = "oneshot";
|
|
};
|
|
script = ''
|
|
${pkgs.iproute2}/bin/ip route add ${cfg.clients} via ${cfg.address} dev ve-vpn || true
|
|
'';
|
|
};
|
|
|
|
containers.vpn = container.mkContainer cfg {
|
|
bindMounts = {
|
|
"/data" = {
|
|
hostPath = "${cfg.storage}/data";
|
|
isReadOnly = true;
|
|
};
|
|
};
|
|
|
|
config = { ... }: container.mkContainerConfig cfg {
|
|
boot.kernel.sysctl = {
|
|
"net.ipv4.conf.all.src_valid_mark" = 1;
|
|
"net.ipv4.ip_forward" = 1;
|
|
};
|
|
environment.systemPackages = with pkgs; [
|
|
easyrsa
|
|
openvpn
|
|
];
|
|
users = {
|
|
groups.openvpn = {};
|
|
users.openvpn = {
|
|
group = "openvpn";
|
|
isSystemUser = true;
|
|
uid = 1000;
|
|
};
|
|
};
|
|
# NOTE: Change the `server` to match `cfg.clients` or write a substring here.
|
|
services.openvpn.servers.vpn = {
|
|
autoStart = true;
|
|
config = util.trimTabs ''
|
|
ca /data/pki/ca.crt
|
|
cert /data/pki/issued/home.crt
|
|
client-to-client
|
|
crl-verify /data/pki/crl.pem
|
|
dev tun
|
|
dh /data/dh2048.pem
|
|
explicit-exit-notify 1
|
|
group openvpn
|
|
ifconfig-pool-persist ipp.txt
|
|
keepalive 10 120
|
|
key /data/pki/private/home.key
|
|
persist-tun
|
|
port ${toString cfg.port}
|
|
proto udp
|
|
push "dhcp-option DNS 10.0.0.1"
|
|
push "dhcp-option DNS 10.0.0.1"
|
|
push "route 10.0.0.0 255.0.0.0"
|
|
push "route 192.168.1.0 255.255.255.0"
|
|
server 10.1.1.0 255.255.255.0
|
|
status openvpn-status.log
|
|
topology subnet
|
|
user openvpn
|
|
verb 4
|
|
'';
|
|
};
|
|
};
|
|
};
|
|
};
|
|
}
|