movefasta/nixpkgs
0
0
Fork 0
mirror of https://github.com/NixOS/nixpkgs.git synced 2025-07-13 21:50:33 +03:00
Code Activity

nixos/mullvad-vpn: add mullvad-exclude wrapper & systemPackage

Browse source
This commit is contained in:
Patrick Jackson 2022-11-07 09:40:21 -08:00 • committed by Cole Helbling
parent 9959fe259d
commit b0c6f4ae05
1 changed files with 19 additions and 0 deletions
Download patch file Download diff file Expand all files Collapse all files

19
nixos/modules/services/networking/mullvad-vpn.nix
View file

@ -14,6 +14,15 @@ with lib;
''; '';
}; };
enableExcludeWrapper = mkOption {
type = types.bool;
default = true;
description = lib.mdDoc ''
This option activates the wrapper that allows the use of mullvad-exclude.
Might have minor security impact, so consider disabling if you do not use the feature.
'';
};
package = mkOption { package = mkOption {
type = types.package; type = types.package;
default = pkgs.mullvad; default = pkgs.mullvad;
@ -27,12 +36,22 @@ with lib;
config = mkIf cfg.enable { config = mkIf cfg.enable {
boot.kernelModules = [ "tun" ]; boot.kernelModules = [ "tun" ];
environment.systemPackages = [ cfg.package ];
# mullvad-daemon writes to /etc/iproute2/rt_tables # mullvad-daemon writes to /etc/iproute2/rt_tables
networking.iproute2.enable = true; networking.iproute2.enable = true;
# See https://github.com/NixOS/nixpkgs/issues/113589 # See https://github.com/NixOS/nixpkgs/issues/113589
networking.firewall.checkReversePath = "loose"; networking.firewall.checkReversePath = "loose";
# See https://github.com/NixOS/nixpkgs/issues/176603
security.wrappers.mullvad-exclude = mkIf cfg.enableExcludeWrapper {
setuid = true;
owner = "root";
group = "root";
source = "${cfg.package}/bin/mullvad-exclude";
};
systemd.services.mullvad-daemon = { systemd.services.mullvad-daemon = {
description = "Mullvad VPN daemon"; description = "Mullvad VPN daemon";
wantedBy = [ "multi-user.target" ]; wantedBy = [ "multi-user.target" ];