pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.boot.initrd.network.openvpn;
8
9in
10
11{
12
13 options = {
14
15 boot.initrd.network.openvpn.enable = mkOption {
16 type = types.bool;
17 default = false;
18 description = lib.mdDoc ''
19 Starts an OpenVPN client during initrd boot. It can be used to e.g.
20 remotely accessing the SSH service controlled by
21 {option}`boot.initrd.network.ssh` or other network services
22 included. Service is killed when stage-1 boot is finished.
23 '';
24 };
25
26 boot.initrd.network.openvpn.configuration = mkOption {
27 type = types.path; # Same type as boot.initrd.secrets
28 description = lib.mdDoc ''
29 The configuration file for OpenVPN.
30
31 ::: {.warning}
32 Unless your bootloader supports initrd secrets, this configuration
33 is stored insecurely in the global Nix store.
34 :::
35 '';
36 example = literalExpression "./configuration.ovpn";
37 };
38
39 };
40
41 config = mkIf (config.boot.initrd.network.enable && cfg.enable) {
42 assertions = [
43 {
44 assertion = cfg.configuration != null;
45 message = "You should specify a configuration for initrd OpenVPN";
46 }
47 ];
48
49 # Add kernel modules needed for OpenVPN
50 boot.initrd.kernelModules = [ "tun" "tap" ];
51
52 # Add openvpn and ip binaries to the initrd
53 # The shared libraries are required for DNS resolution
54 boot.initrd.extraUtilsCommands = ''
55 copy_bin_and_libs ${pkgs.openvpn}/bin/openvpn
56 copy_bin_and_libs ${pkgs.iproute2}/bin/ip
57
58 cp -pv ${pkgs.glibc}/lib/libresolv.so.2 $out/lib
59 cp -pv ${pkgs.glibc}/lib/libnss_dns.so.2 $out/lib
60 '';
61
62 boot.initrd.secrets = {
63 "/etc/initrd.ovpn" = cfg.configuration;
64 };
65
66 # openvpn --version would exit with 1 instead of 0
67 boot.initrd.extraUtilsCommandsTest = ''
68 $out/bin/openvpn --show-gateway
69 '';
70
71 # Add `iproute /bin/ip` to the config, to ensure that openvpn
72 # is able to set the routes
73 boot.initrd.network.postCommands = ''
74 (cat /etc/initrd.ovpn; echo -e '\niproute /bin/ip') | \
75 openvpn /dev/stdin &
76 '';
77 };
78
79}