From e2369d551e211c0eeb360868c2bba30564e33ca0 Mon Sep 17 00:00:00 2001 From: makefu Date: Mon, 18 Dec 2017 21:27:26 +0100 Subject: ma vpn: add vpnws client and server --- makefu/2configs/vpn/vpnws/client.nix | 9 ++++++++ makefu/2configs/vpn/vpnws/server.nix | 42 ++++++++++++++++++++++++++++++++++++ 2 files changed, 51 insertions(+) create mode 100644 makefu/2configs/vpn/vpnws/client.nix create mode 100644 makefu/2configs/vpn/vpnws/server.nix (limited to 'makefu/2configs/vpn/vpnws') diff --git a/makefu/2configs/vpn/vpnws/client.nix b/makefu/2configs/vpn/vpnws/client.nix new file mode 100644 index 000000000..d06bc27db --- /dev/null +++ b/makefu/2configs/vpn/vpnws/client.nix @@ -0,0 +1,9 @@ +{ pkgs, ... }: +{ + users.users.makefu.packages = with pkgs; [ iproute vpn-ws ]; + # vpn-ws-client vpnws wss://localhost/vpn --no-verify --exec "ip link set vpnws up;ip addr add 10.244.1.2/24 dev vpnws" + networking.interfaces.vpnws = { + virtual = true; + virtualType = "tap"; + }; +} diff --git a/makefu/2configs/vpn/vpnws/server.nix b/makefu/2configs/vpn/vpnws/server.nix new file mode 100644 index 000000000..6baa5ff11 --- /dev/null +++ b/makefu/2configs/vpn/vpnws/server.nix @@ -0,0 +1,42 @@ +{pkgs, options, ... }: +let + pkg = pkgs.vpn-ws; + uid = "nginx"; + gid = "nginx"; + ip = "${pkgs.iproute}/bin/ip"; + socket = "/run/vpn.sock"; + htpasswd = (toString ) + "/vpn-ws-auth"; + nginx-prepared-secrets = "/var/spool/nginx/vpn-ws-auth"; +in { + systemd.services.vpn-ws-auth-prepare = { + wantedBy = [ "multi-user.target" ]; + before = [ "nginx.service" ]; + script = "install -m700 -o${uid} -g${gid} ${htpasswd} ${nginx-prepared-secrets}"; + }; + services.nginx.virtualHosts."euer.krebsco.de".locations."/vpn" = { + extraConfig = '' + auth_basic "please stand by..."; + auth_basic_user_file ${nginx-prepared-secrets}; + uwsgi_pass unix:${socket}; + include ${pkgs.nginx}/conf/uwsgi_params; + ''; + }; + + networking.interfaces.vpnws = { + virtual = true; + virtualType = "tap"; + }; + systemd.services.vpnws = { + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + serviceConfig = { + Restart = "always"; + PrivateTmp = true; + ExecStartPre = pkgs.writeDash "vpnws-pre" '' + ${ip} link set vpnws up + ${ip} addr add 10.244.1.1/24 dev vpnws || : + ''; + ExecStart = "${pkg}/bin/vpn-ws --uid ${uid} --gid ${gid} --tuntap vpnws ${socket}"; + }; + }; +} -- cgit v1.2.3