From 1fff5ae3724a811c6205e1e7abf5052e05412757 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 18 Dec 2017 21:26:45 +0100 Subject: ma nginx: add vpn-ws prototype --- makefu/2configs/nginx/euer.blog.vpn.nix | 35 +++++++++++++++++++++++++++++++++ 1 file changed, 35 insertions(+) create mode 100644 makefu/2configs/nginx/euer.blog.vpn.nix (limited to 'makefu/2configs/nginx/euer.blog.vpn.nix') diff --git a/makefu/2configs/nginx/euer.blog.vpn.nix b/makefu/2configs/nginx/euer.blog.vpn.nix new file mode 100644 index 000000000..b3db0bc60 --- /dev/null +++ b/makefu/2configs/nginx/euer.blog.vpn.nix @@ -0,0 +1,35 @@ +{pkgs, options, ... }: +let + pkg = pkgs.vpn-ws; + uid = "nginx"; + gid = "nginx"; + ip = "${pkgs.iproute}/bin/ip"; +in { + services.nginx.virtualHosts."euer.krebsco.de".locations."/vpn" = { + # TODO client auth + extraConfig = '' + uwsgi_pass unix:/run/vpn.sock; + include ${pkgs.nginx}/conf/uwsgi_params; + ''; + }; + + networking.interfaces.vpnws = { + virtual = true; + virtualType = "tap"; + }; + systemd.services.vpnws = { + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + serviceConfig = { + Restart = "always"; + PrivateTmp = true; + ExecStartPre = pkgs.writeDash "vpnws-pre" '' + ${ip} link set vpnws up + ${ip} addr add 10.244.1.1/24 dev vpnws || : + ''; + ExecStart = pkgs.writeDash "vpnws-start" '' + ${pkg}/bin/vpn-ws --tuntap vpnws /run/vpn.sock + ''; + }; + }; +} -- cgit v1.2.3