summaryrefslogtreecommitdiffstats
path: root/makefu/2configs/vpn/vpnws
diff options
context:
space:
mode:
authortv <tv@krebsco.de>2018-01-02 20:58:59 +0100
committertv <tv@krebsco.de>2018-01-02 20:58:59 +0100
commit493984d97e6deaee3d7b358724e83c59bccb212d (patch)
tree691e019ae0b55d48a9681d9c26ae65e6c83d1d0f /makefu/2configs/vpn/vpnws
parent84fdbeba2ceee152a128f5e9013043c172c07ecf (diff)
parente48b4eb4606f6d0ec0b930016a53e7e7cfcbfb64 (diff)
Merge remote-tracking branch 'prism/master'
Diffstat (limited to 'makefu/2configs/vpn/vpnws')
-rw-r--r--makefu/2configs/vpn/vpnws/client.nix9
-rw-r--r--makefu/2configs/vpn/vpnws/server.nix42
2 files changed, 51 insertions, 0 deletions
diff --git a/makefu/2configs/vpn/vpnws/client.nix b/makefu/2configs/vpn/vpnws/client.nix
new file mode 100644
index 000000000..d06bc27db
--- /dev/null
+++ b/makefu/2configs/vpn/vpnws/client.nix
@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+{
+ users.users.makefu.packages = with pkgs; [ iproute vpn-ws ];
+ # vpn-ws-client vpnws wss://localhost/vpn --no-verify --exec "ip link set vpnws up;ip addr add 10.244.1.2/24 dev vpnws"
+ networking.interfaces.vpnws = {
+ virtual = true;
+ virtualType = "tap";
+ };
+}
diff --git a/makefu/2configs/vpn/vpnws/server.nix b/makefu/2configs/vpn/vpnws/server.nix
new file mode 100644
index 000000000..6baa5ff11
--- /dev/null
+++ b/makefu/2configs/vpn/vpnws/server.nix
@@ -0,0 +1,42 @@
+{pkgs, options, ... }:
+let
+ pkg = pkgs.vpn-ws;
+ uid = "nginx";
+ gid = "nginx";
+ ip = "${pkgs.iproute}/bin/ip";
+ socket = "/run/vpn.sock";
+ htpasswd = (toString <secrets>) + "/vpn-ws-auth";
+ nginx-prepared-secrets = "/var/spool/nginx/vpn-ws-auth";
+in {
+ systemd.services.vpn-ws-auth-prepare = {
+ wantedBy = [ "multi-user.target" ];
+ before = [ "nginx.service" ];
+ script = "install -m700 -o${uid} -g${gid} ${htpasswd} ${nginx-prepared-secrets}";
+ };
+ services.nginx.virtualHosts."euer.krebsco.de".locations."/vpn" = {
+ extraConfig = ''
+ auth_basic "please stand by...";
+ auth_basic_user_file ${nginx-prepared-secrets};
+ uwsgi_pass unix:${socket};
+ include ${pkgs.nginx}/conf/uwsgi_params;
+ '';
+ };
+
+ networking.interfaces.vpnws = {
+ virtual = true;
+ virtualType = "tap";
+ };
+ systemd.services.vpnws = {
+ wantedBy = [ "multi-user.target" ];
+ after = [ "network.target" ];
+ serviceConfig = {
+ Restart = "always";
+ PrivateTmp = true;
+ ExecStartPre = pkgs.writeDash "vpnws-pre" ''
+ ${ip} link set vpnws up
+ ${ip} addr add 10.244.1.1/24 dev vpnws || :
+ '';
+ ExecStart = "${pkg}/bin/vpn-ws --uid ${uid} --gid ${gid} --tuntap vpnws ${socket}";
+ };
+ };
+}