diff options
| author | makefu <github@syntax-fehler.de> | 2017-12-18 21:27:26 +0100 |
|---|---|---|
| committer | makefu <github@syntax-fehler.de> | 2017-12-18 21:27:26 +0100 |
| commit | e2369d551e211c0eeb360868c2bba30564e33ca0 (patch) | |
| tree | c8c19f08e0ad3261eb43a99f32b35e7b8121fa52 | |
| parent | 4d4d11a76501246e485ed73f33277ce470d32dfd (diff) | |
ma vpn: add vpnws client and server
| -rw-r--r-- | makefu/2configs/vpn/vpnws/client.nix | 9 | ||||
| -rw-r--r-- | makefu/2configs/vpn/vpnws/server.nix (renamed from makefu/2configs/nginx/euer.blog.vpn.nix) | 17 |
2 files changed, 21 insertions, 5 deletions
diff --git a/makefu/2configs/vpn/vpnws/client.nix b/makefu/2configs/vpn/vpnws/client.nix new file mode 100644 index 000000000..d06bc27db --- /dev/null +++ b/makefu/2configs/vpn/vpnws/client.nix @@ -0,0 +1,9 @@ +{ pkgs, ... }: +{ + users.users.makefu.packages = with pkgs; [ iproute vpn-ws ]; + # vpn-ws-client vpnws wss://localhost/vpn --no-verify --exec "ip link set vpnws up;ip addr add 10.244.1.2/24 dev vpnws" + networking.interfaces.vpnws = { + virtual = true; + virtualType = "tap"; + }; +} diff --git a/makefu/2configs/nginx/euer.blog.vpn.nix b/makefu/2configs/vpn/vpnws/server.nix index b3db0bc60..6baa5ff11 100644 --- a/makefu/2configs/nginx/euer.blog.vpn.nix +++ b/makefu/2configs/vpn/vpnws/server.nix @@ -4,11 +4,20 @@ let uid = "nginx"; gid = "nginx"; ip = "${pkgs.iproute}/bin/ip"; + socket = "/run/vpn.sock"; + htpasswd = (toString <secrets>) + "/vpn-ws-auth"; + nginx-prepared-secrets = "/var/spool/nginx/vpn-ws-auth"; in { + systemd.services.vpn-ws-auth-prepare = { + wantedBy = [ "multi-user.target" ]; + before = [ "nginx.service" ]; + script = "install -m700 -o${uid} -g${gid} ${htpasswd} ${nginx-prepared-secrets}"; + }; services.nginx.virtualHosts."euer.krebsco.de".locations."/vpn" = { - # TODO client auth extraConfig = '' - uwsgi_pass unix:/run/vpn.sock; + auth_basic "please stand by..."; + auth_basic_user_file ${nginx-prepared-secrets}; + uwsgi_pass unix:${socket}; include ${pkgs.nginx}/conf/uwsgi_params; ''; }; @@ -27,9 +36,7 @@ in { ${ip} link set vpnws up ${ip} addr add 10.244.1.1/24 dev vpnws || : ''; - ExecStart = pkgs.writeDash "vpnws-start" '' - ${pkg}/bin/vpn-ws --tuntap vpnws /run/vpn.sock - ''; + ExecStart = "${pkg}/bin/vpn-ws --uid ${uid} --gid ${gid} --tuntap vpnws ${socket}"; }; }; } |