Merge pull request #226514 from AtaraxiaSjel/update/ivpn

nixos/doc/manual/release-notes/rl-2305.section.md

@@ -117,6 +117,8 @@ In addition to numerous new and upgraded packages, this release has the followin
 
 - [hardware.ipu6](#opt-hardware.ipu6.enable) adds support for ipu6 based webcams on intel tiger lake and alder lake.
 
+- [ivpn](https://www.ivpn.net/), a secure, private VPN with fast WireGuard connections. Available as [services.ivpn](#opt-services.ivpn.enable).
+
 ## Backward Incompatibilities {#sec-release-23.05-incompatibilities}
 
 <!-- To avoid merge conflicts, consider adding your item at an arbitrary place in the list instead. -->

nixos/modules/module-list.nix

@@ -885,6 +885,7 @@
   ./services/networking/iscsi/initiator.nix
   ./services/networking/iscsi/root-initiator.nix
   ./services/networking/iscsi/target.nix
+  ./services/networking/ivpn.nix
   ./services/networking/iwd.nix
   ./services/networking/jibri/default.nix
   ./services/networking/jicofo.nix

nixos/modules/services/networking/ivpn.nix

@@ -0,0 +1,51 @@
+{ config, lib, pkgs, ... }:
+let
+  cfg = config.services.ivpn;
+in
+with lib;
+{
+  options.services.ivpn = {
+    enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = lib.mdDoc ''
+        This option enables iVPN daemon.
+        This sets {option}`networking.firewall.checkReversePath` to "loose", which might be undesirable for security.
+      '';
+    };
+  };
+
+  config = mkIf cfg.enable {
+    boot.kernelModules = [ "tun" ];
+
+    environment.systemPackages = with pkgs; [ ivpn ivpn-service ];
+
+    # iVPN writes to /etc/iproute2/rt_tables
+    networking.iproute2.enable = true;
+    networking.firewall.checkReversePath = "loose";
+
+    systemd.services.ivpn-service = {
+      description = "iVPN daemon";
+      wantedBy = [ "multi-user.target" ];
+      wants = [ "network.target" ];
+      after = [
+        "network-online.target"
+        "NetworkManager.service"
+        "systemd-resolved.service"
+      ];
+      path = [
+        # Needed for mount
+        "/run/wrappers"
+      ];
+      startLimitBurst = 5;
+      startLimitIntervalSec = 20;
+      serviceConfig = {
+        ExecStart = "${pkgs.ivpn-service}/bin/ivpn-service --logging";
+        Restart = "always";
+        RestartSec = 1;
+      };
+    };
+  };
+
+  meta.maintainers = with maintainers; [ ataraxiasjel ];
+}

pkgs/tools/networking/ivpn/default.nix

@@ -2,17 +2,26 @@
 , fetchFromGitHub
 , lib
 , wirelesstools
+, makeWrapper
+, wireguard-tools
+, openvpn
+, obfs4
+, iproute2
+, dnscrypt-proxy2
+, iptables
+, gawk
+, util-linux
 }:
 
 builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
   inherit pname;
-  version = "3.10.0";
+  version = "3.10.15";
 
   src = fetchFromGitHub {
     owner = "ivpn";
     repo = "desktop-app";
     rev = "v${version}";
-    hash = "sha256-oX1PWIBPDcvBTxstEiN2WosiVUNXJoloppkpcABSi7Y=";
+    hash = "sha256-3yVRVM98tVjot3gIkUb/CDwmwKdOOBjBjzGL6htDtpk=";
   };
 
   ldflags = [
@@ -31,16 +40,52 @@ builtins.mapAttrs (pname: attrs: buildGoModule (attrs // rec {
     homepage = "https://www.ivpn.net/apps";
     changelog = "https://github.com/ivpn/desktop-app/releases/tag/v${version}";
     license = licenses.gpl3Only;
-    maintainers = with maintainers; [ urandom ];
+    maintainers = with maintainers; [ urandom ataraxiasjel ];
   };
 })) {
   ivpn = {
     modRoot = "cli";
-    vendorHash = "sha256-5FvKR1Kz91Yi/uILVFyJRnwFZSmZ5qnotXqOI4fKLbY=";
+    vendorHash = "sha256-T49AE3SUmdP3Tu9Sp5C/QryKDto/NzEqRuUQ3+aJFL0=";
   };
   ivpn-service = {
     modRoot = "daemon";
     vendorHash = "sha256-9Rk6ruMpyWtQe+90kw4F8OLq7/JcDSrG6ufkfcrS4W8=";
+    nativeBuildInputs = [ makeWrapper ];
     buildInputs = [ wirelesstools ];
+
+    patches = [ ./permissions.patch ];
+    postPatch = ''
+      substituteInPlace daemon/service/platform/platform_linux.go \
+        --replace 'openVpnBinaryPath = "/usr/sbin/openvpn"' \
+        'openVpnBinaryPath = "${openvpn}/bin/openvpn"' \
+        --replace 'routeCommand = "/sbin/ip route"' \
+        'routeCommand = "${iproute2}/bin/ip route"'
+
+      substituteInPlace daemon/netinfo/netinfo_linux.go \
+        --replace 'retErr := shell.ExecAndProcessOutput(log, outParse, "", "/sbin/ip", "route")' \
+        'retErr := shell.ExecAndProcessOutput(log, outParse, "", "${iproute2}/bin/ip", "route")'
+
+      substituteInPlace daemon/service/platform/platform_linux_release.go \
+        --replace 'installDir := "/opt/ivpn"' "installDir := \"$out\"" \
+        --replace 'obfsproxyStartScript = path.Join(installDir, "obfsproxy/obfs4proxy")' \
+        'obfsproxyStartScript = "${obfs4}/bin/obfs4proxy"' \
+        --replace 'wgBinaryPath = path.Join(installDir, "wireguard-tools/wg-quick")' \
+        'wgBinaryPath = "${wireguard-tools}/bin/wg-quick"' \
+        --replace 'wgToolBinaryPath = path.Join(installDir, "wireguard-tools/wg")' \
+        'wgToolBinaryPath = "${wireguard-tools}/bin/wg"' \
+        --replace 'dnscryptproxyBinPath = path.Join(installDir, "dnscrypt-proxy/dnscrypt-proxy")' \
+        'dnscryptproxyBinPath = "${dnscrypt-proxy2}/bin/dnscrypt-proxy"'
+    '';
+
+    postFixup = ''
+      mkdir -p $out/etc
+      cp -r $src/daemon/References/Linux/etc/* $out/etc/
+      cp -r $src/daemon/References/common/etc/* $out/etc/
+
+      patchShebangs --build $out/etc/firewall.sh $out/etc/splittun.sh $out/etc/client.down $out/etc/client.up
+
+      wrapProgram "$out/bin/ivpn-service" \
+        --suffix PATH : ${lib.makeBinPath [ iptables gawk util-linux ]}
+    '';
   };
 }

pkgs/tools/networking/ivpn/permissions.patch

@@ -0,0 +1,27 @@
+diff --git a/daemon/service/platform/platform.go b/daemon/service/platform/platform.go
+index 941a99a7..df821c4d 100644
+--- a/daemon/service/platform/platform.go
++++ b/daemon/service/platform/platform.go
+@@ -111,12 +111,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	}
+
+ 	// checking file permissions
+-	if err := checkFileAccessRightsStaticConfig("openvpnCaKeyFile", openvpnCaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+-	if err := checkFileAccessRightsStaticConfig("openvpnTaKeyFile", openvpnTaKeyFile); err != nil {
+-		errors = append(errors, err)
+-	}
+
+ 	if len(openvpnUpScript) > 0 {
+ 		if err := checkFileAccessRightsExecutable("openvpnUpScript", openvpnUpScript); err != nil {
+@@ -149,9 +143,6 @@ func Init() (warnings []string, errors []error, logInfo []string) {
+ 	if err := checkFileAccessRightsExecutable("dnscryptproxyBinPath", dnscryptproxyBinPath); err != nil {
+ 		errors = append(errors, err)
+ 	}
+-	if err := checkFileAccessRightsStaticConfig("dnscryptproxyConfigTemplate", dnscryptproxyConfigTemplate); err != nil {
+-		errors = append(errors, err)
+-	}
+
+ 	if len(routeCommand) > 0 {
+ 		routeBinary := strings.Split(routeCommand, " ")[0]