pyrox.dev
1{
2 config,
3 lib,
4 pkgs,
5 ...
6}:
7
8with lib;
9
10let
11
12 cfg = config.boot.initrd.network.openvpn;
13
14in
15
16{
17
18 options = {
19
20 boot.initrd.network.openvpn.enable = mkOption {
21 type = types.bool;
22 default = false;
23 description = ''
24 Starts an OpenVPN client during initrd boot. It can be used to e.g.
25 remotely accessing the SSH service controlled by
26 {option}`boot.initrd.network.ssh` or other network services
27 included. Service is killed when stage-1 boot is finished.
28 '';
29 };
30
31 boot.initrd.network.openvpn.configuration = mkOption {
32 type = types.path; # Same type as boot.initrd.secrets
33 description = ''
34 The configuration file for OpenVPN.
35
36 ::: {.warning}
37 Unless your bootloader supports initrd secrets, this configuration
38 is stored insecurely in the global Nix store.
39 :::
40 '';
41 example = literalExpression "./configuration.ovpn";
42 };
43
44 };
45
46 config = mkIf (config.boot.initrd.network.enable && cfg.enable) {
47 assertions = [
48 {
49 assertion = cfg.configuration != null;
50 message = "You should specify a configuration for initrd OpenVPN";
51 }
52 ];
53
54 # Add kernel modules needed for OpenVPN
55 boot.initrd.kernelModules = [
56 "tun"
57 "tap"
58 ];
59
60 # Add openvpn and ip binaries to the initrd
61 # The shared libraries are required for DNS resolution
62 boot.initrd.extraUtilsCommands = mkIf (!config.boot.initrd.systemd.enable) ''
63 copy_bin_and_libs ${pkgs.openvpn}/bin/openvpn
64 copy_bin_and_libs ${pkgs.iproute2}/bin/ip
65
66 cp -pv ${pkgs.glibc}/lib/libresolv.so.2 $out/lib
67 cp -pv ${pkgs.glibc}/lib/libnss_dns.so.2 $out/lib
68 '';
69
70 boot.initrd.systemd.storePaths = [
71 "${pkgs.openvpn}/bin/openvpn"
72 "${pkgs.iproute2}/bin/ip"
73 "${pkgs.glibc}/lib/libresolv.so.2"
74 "${pkgs.glibc}/lib/libnss_dns.so.2"
75 ];
76
77 boot.initrd.secrets = {
78 "/etc/initrd.ovpn" = cfg.configuration;
79 };
80
81 # openvpn --version would exit with 1 instead of 0
82 boot.initrd.extraUtilsCommandsTest = mkIf (!config.boot.initrd.systemd.enable) ''
83 $out/bin/openvpn --show-gateway
84 '';
85
86 boot.initrd.network.postCommands = mkIf (!config.boot.initrd.systemd.enable) ''
87 openvpn /etc/initrd.ovpn &
88 '';
89
90 boot.initrd.systemd.services.openvpn = {
91 wantedBy = [ "initrd.target" ];
92 path = [ pkgs.iproute2 ];
93 after = [
94 "network.target"
95 "initrd-nixos-copy-secrets.service"
96 ];
97 serviceConfig.ExecStart = "${pkgs.openvpn}/bin/openvpn /etc/initrd.ovpn";
98 serviceConfig.Type = "notify";
99 };
100 };
101
102}