pyrox.dev
1{ config, lib, pkgs, ... }:
2
3with lib;
4
5let
6
7 cfg = config.boot.initrd.network.openvpn;
8
9in
10
11{
12
13 options = {
14
15 boot.initrd.network.openvpn.enable = mkOption {
16 type = types.bool;
17 default = false;
18 description = ''
19 Starts an OpenVPN client during initrd boot. It can be used to e.g.
20 remotely accessing the SSH service controlled by
21 {option}`boot.initrd.network.ssh` or other network services
22 included. Service is killed when stage-1 boot is finished.
23 '';
24 };
25
26 boot.initrd.network.openvpn.configuration = mkOption {
27 type = types.path; # Same type as boot.initrd.secrets
28 description = ''
29 The configuration file for OpenVPN.
30
31 ::: {.warning}
32 Unless your bootloader supports initrd secrets, this configuration
33 is stored insecurely in the global Nix store.
34 :::
35 '';
36 example = literalExpression "./configuration.ovpn";
37 };
38
39 };
40
41 config = mkIf (config.boot.initrd.network.enable && cfg.enable) {
42 assertions = [
43 {
44 assertion = cfg.configuration != null;
45 message = "You should specify a configuration for initrd OpenVPN";
46 }
47 ];
48
49 # Add kernel modules needed for OpenVPN
50 boot.initrd.kernelModules = [ "tun" "tap" ];
51
52 # Add openvpn and ip binaries to the initrd
53 # The shared libraries are required for DNS resolution
54 boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) ''
55 copy_bin_and_libs ${pkgs.openvpn}/bin/openvpn
56 copy_bin_and_libs ${pkgs.iproute2}/bin/ip
57
58 cp -pv ${pkgs.glibc}/lib/libresolv.so.2 $out/lib
59 cp -pv ${pkgs.glibc}/lib/libnss_dns.so.2 $out/lib
60 '';
61
62 boot.initrd.systemd.storePaths = [
63 "${pkgs.openvpn}/bin/openvpn"
64 "${pkgs.iproute2}/bin/ip"
65 "${pkgs.glibc}/lib/libresolv.so.2"
66 "${pkgs.glibc}/lib/libnss_dns.so.2"
67 ];
68
69 boot.initrd.secrets = {
70 "/etc/initrd.ovpn" = cfg.configuration;
71 };
72
73 # openvpn --version would exit with 1 instead of 0
74 boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable) ''
75 $out/bin/openvpn --show-gateway
76 '';
77
78 boot.initrd.network.postCommands = mkIf (!config.boot.initrd.systemd.enable) ''
79 openvpn /etc/initrd.ovpn &
80 '';
81
82 boot.initrd.systemd.services.openvpn = {
83 wantedBy = [ "initrd.target" ];
84 path = [ pkgs.iproute2 ];
85 after = [ "network.target" "initrd-nixos-copy-secrets.service" ];
86 serviceConfig.ExecStart = "${pkgs.openvpn}/bin/openvpn /etc/initrd.ovpn";
87 serviceConfig.Type = "notify";
88 };
89 };
90
91}