From e2369d551e211c0eeb360868c2bba30564e33ca0 Mon Sep 17 00:00:00 2001
From: makefu <github@syntax-fehler.de>
Date: Mon, 18 Dec 2017 21:27:26 +0100
Subject: ma vpn: add vpnws client and server

---
 makefu/2configs/nginx/euer.blog.vpn.nix | 35 ---------------------------
 makefu/2configs/vpn/vpnws/client.nix    |  9 +++++++
 makefu/2configs/vpn/vpnws/server.nix    | 42 +++++++++++++++++++++++++++++++++
 3 files changed, 51 insertions(+), 35 deletions(-)
 delete mode 100644 makefu/2configs/nginx/euer.blog.vpn.nix
 create mode 100644 makefu/2configs/vpn/vpnws/client.nix
 create mode 100644 makefu/2configs/vpn/vpnws/server.nix

diff --git a/makefu/2configs/nginx/euer.blog.vpn.nix b/makefu/2configs/nginx/euer.blog.vpn.nix
deleted file mode 100644
index b3db0bc60..000000000
--- a/makefu/2configs/nginx/euer.blog.vpn.nix
+++ /dev/null
@@ -1,35 +0,0 @@
-{pkgs, options, ... }:
-let
-  pkg = pkgs.vpn-ws;
-  uid = "nginx";
-  gid = "nginx";
-  ip = "${pkgs.iproute}/bin/ip";
-in {
-  services.nginx.virtualHosts."euer.krebsco.de".locations."/vpn" = {
-    # TODO client auth
-    extraConfig = ''
-      uwsgi_pass   unix:/run/vpn.sock;
-      include      ${pkgs.nginx}/conf/uwsgi_params;
-    '';
-  };
-
-  networking.interfaces.vpnws = {
-    virtual = true;
-    virtualType = "tap";
-  };
-  systemd.services.vpnws = {
-    wantedBy = [ "multi-user.target" ];
-    after = [ "network.target" ];
-    serviceConfig = {
-      Restart = "always";
-      PrivateTmp = true;
-      ExecStartPre = pkgs.writeDash "vpnws-pre" ''
-        ${ip} link set vpnws up
-        ${ip} addr add 10.244.1.1/24 dev vpnws || :
-      '';
-      ExecStart = pkgs.writeDash "vpnws-start" ''
-        ${pkg}/bin/vpn-ws --tuntap vpnws /run/vpn.sock
-      '';
-    };
-  };
-}
diff --git a/makefu/2configs/vpn/vpnws/client.nix b/makefu/2configs/vpn/vpnws/client.nix
new file mode 100644
index 000000000..d06bc27db
--- /dev/null
+++ b/makefu/2configs/vpn/vpnws/client.nix
@@ -0,0 +1,9 @@
+{ pkgs, ... }:
+{
+  users.users.makefu.packages = with pkgs; [ iproute vpn-ws ];
+  # vpn-ws-client  vpnws wss://localhost/vpn --no-verify --exec "ip link set vpnws up;ip addr add 10.244.1.2/24 dev vpnws"
+  networking.interfaces.vpnws = {
+    virtual = true;
+    virtualType = "tap";
+  };
+}
diff --git a/makefu/2configs/vpn/vpnws/server.nix b/makefu/2configs/vpn/vpnws/server.nix
new file mode 100644
index 000000000..6baa5ff11
--- /dev/null
+++ b/makefu/2configs/vpn/vpnws/server.nix
@@ -0,0 +1,42 @@
+{pkgs, options, ... }:
+let
+  pkg = pkgs.vpn-ws;
+  uid = "nginx";
+  gid = "nginx";
+  ip = "${pkgs.iproute}/bin/ip";
+  socket = "/run/vpn.sock";
+  htpasswd = (toString <secrets>) + "/vpn-ws-auth";
+  nginx-prepared-secrets = "/var/spool/nginx/vpn-ws-auth";
+in {
+  systemd.services.vpn-ws-auth-prepare = {
+    wantedBy = [ "multi-user.target" ];
+    before = [ "nginx.service" ];
+    script = "install -m700 -o${uid} -g${gid} ${htpasswd} ${nginx-prepared-secrets}";
+  };
+  services.nginx.virtualHosts."euer.krebsco.de".locations."/vpn" = {
+    extraConfig = ''
+      auth_basic "please stand by...";
+      auth_basic_user_file ${nginx-prepared-secrets};
+      uwsgi_pass   unix:${socket};
+      include      ${pkgs.nginx}/conf/uwsgi_params;
+    '';
+  };
+
+  networking.interfaces.vpnws = {
+    virtual = true;
+    virtualType = "tap";
+  };
+  systemd.services.vpnws = {
+    wantedBy = [ "multi-user.target" ];
+    after = [ "network.target" ];
+    serviceConfig = {
+      Restart = "always";
+      PrivateTmp = true;
+      ExecStartPre = pkgs.writeDash "vpnws-pre" ''
+        ${ip} link set vpnws up
+        ${ip} addr add 10.244.1.1/24 dev vpnws || :
+      '';
+      ExecStart = "${pkg}/bin/vpn-ws --uid ${uid} --gid ${gid} --tuntap vpnws ${socket}";
+    };
+  };
+}
-- 
cgit v1.2.3