pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4with (import ./param-lib.nix lib);
5
6let
7 cfg = config.services.strongswan-swanctl;
8 configFile = pkgs.writeText "swanctl.conf"
9 ( (paramsToConf cfg.swanctl swanctlParams)
10 + (concatMapStrings (i: "\ninclude ${i}") cfg.includes));
11 swanctlParams = import ./swanctl-params.nix lib;
12in {
13 options.services.strongswan-swanctl = {
14 enable = mkEnableOption "strongswan-swanctl service";
15
16 package = mkPackageOption pkgs "strongswan" { };
17
18 strongswan.extraConfig = mkOption {
19 type = types.str;
20 default = "";
21 description = ''
22 Contents of the `strongswan.conf` file.
23 '';
24 };
25
26 swanctl = paramsToOptions swanctlParams;
27 includes = mkOption {
28 type = types.listOf types.path;
29 default = [];
30 description = ''
31 Extra configuration files to include in the swanctl configuration. This can be used to provide secret values from outside the nix store.
32 '';
33 };
34 };
35
36 config = mkIf cfg.enable {
37
38 assertions = [
39 { assertion = !config.services.strongswan.enable;
40 message = "cannot enable both services.strongswan and services.strongswan-swanctl. Choose either one.";
41 }
42 ];
43
44 environment.etc."swanctl/swanctl.conf".source = configFile;
45
46 # The swanctl command complains when the following directories don't exist:
47 # See: https://wiki.strongswan.org/projects/strongswan/wiki/Swanctldirectory
48 systemd.tmpfiles.rules = [
49 "d /etc/swanctl/x509 -" # Trusted X.509 end entity certificates
50 "d /etc/swanctl/x509ca -" # Trusted X.509 Certificate Authority certificates
51 "d /etc/swanctl/x509ocsp -"
52 "d /etc/swanctl/x509aa -" # Trusted X.509 Attribute Authority certificates
53 "d /etc/swanctl/x509ac -" # Attribute Certificates
54 "d /etc/swanctl/x509crl -" # Certificate Revocation Lists
55 "d /etc/swanctl/pubkey -" # Raw public keys
56 "d /etc/swanctl/private -" # Private keys in any format
57 "d /etc/swanctl/rsa -" # PKCS#1 encoded RSA private keys
58 "d /etc/swanctl/ecdsa -" # Plain ECDSA private keys
59 "d /etc/swanctl/bliss -"
60 "d /etc/swanctl/pkcs8 -" # PKCS#8 encoded private keys of any type
61 "d /etc/swanctl/pkcs12 -" # PKCS#12 containers
62 ];
63
64 systemd.services.strongswan-swanctl = {
65 description = "strongSwan IPsec IKEv1/IKEv2 daemon using swanctl";
66 wantedBy = [ "multi-user.target" ];
67 wants = [ "network-online.target" ];
68 after = [ "network-online.target" ];
69 path = with pkgs; [ kmod iproute2 iptables util-linux ];
70 environment = {
71 STRONGSWAN_CONF = pkgs.writeTextFile {
72 name = "strongswan.conf";
73 text = cfg.strongswan.extraConfig;
74 };
75 SWANCTL_DIR = "/etc/swanctl";
76 };
77 restartTriggers = [ config.environment.etc."swanctl/swanctl.conf".source ];
78 serviceConfig = {
79 ExecStart = "${cfg.package}/sbin/charon-systemd";
80 Type = "notify";
81 ExecStartPost = "${cfg.package}/sbin/swanctl --load-all --noprompt";
82 ExecReload = "${cfg.package}/sbin/swanctl --reload";
83 Restart = "on-abnormal";
84 };
85 };
86 };
87}