commit 9936ed4920974c558eded168d2e36e726bd56b11 · pyrox.dev/nixpkgs

+1

nixos/modules/services/networking/networkmanager.nix

···

       335
       335
        
       

     

       336
       336
        
             preStart = ''

     

       337
       337
        
               mkdir -m 700 -p /etc/NetworkManager/system-connections

     

       338
       338
       +
               mkdir -m 700 -p /etc/ipsec.d

     

       338
       339
        
               mkdir -m 755 -p ${stateDirs}

     

       339
       340
        
             '';

     

       340
       341
        
           };

+19 -4

nixos/modules/services/networking/strongswan.nix

···

       32
       32
        
             ${caConf}

     

       33
       33
        
           '';

     

       34
       34
        
       

     

       35
       35
       -
         strongswanConf = {setup, connections, ca, secrets, managePlugins, enabledPlugins}: toFile "strongswan.conf" ''

     

       35
       35
       +
         strongswanConf = {setup, connections, ca, secretsFile, managePlugins, enabledPlugins}: toFile "strongswan.conf" ''

     

       36
       36
        
           charon {

     

       37
       37
        
             ${if managePlugins then "load_modular = no" else ""}

     

       38
       38
        
             ${if managePlugins then ("load = " + (concatStringsSep " " enabledPlugins)) else ""}

     

       39
       39
        
             plugins {

     

       40
       40
        
               stroke {

     

       41
       41
       -
                 secrets_file = ${ipsecSecrets secrets}

     

       41
       41
       +
                 secrets_file = ${secretsFile}

     

       42
       42
        
               }

     

       43
       43
        
             }

     

       44
       44
        
           }

     
···

       135
       135
        
           };

     

       136
       136
        
         };

     

       137
       137
        
       

     

       138
       138
       -
         config = with cfg; mkIf enable {

     

       138
       138
       +
       

     

       139
       139
       +
         config = with cfg;

     

       140
       140
       +
         let

     

       141
       141
       +
           secretsFile = ipsecSecrets cfg.secrets;

     

       142
       142
       +
         in

     

       143
       143
       +
         mkIf enable

     

       144
       144
       +
           {

     

       145
       145
       +
       

     

       146
       146
       +
           # here we should use the default strongswan ipsec.secrets and

     

       147
       147
       +
           # append to it (default one is empty so not a pb for now)

     

       148
       148
       +
           environment.etc."ipsec.secrets".source = secretsFile;

     

       149
       149
       +
       

     

       139
       150
        
           systemd.services.strongswan = {

     

       140
       151
        
             description = "strongSwan IPSec Service";

     

       141
       152
        
             wantedBy = [ "multi-user.target" ];

     
···

       143
       154
        
             wants = [ "keys.target" ];

     

       144
       155
        
             after = [ "network-online.target" "keys.target" ];

     

       145
       156
        
             environment = {

     

       146
       146
       -
               STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secrets managePlugins enabledPlugins; };

     

       157
       157
       +
               STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secretsFile managePlugins enabledPlugins; };

     

       147
       158
        
             };

     

       148
       159
        
             serviceConfig = {

     

       149
       160
        
               ExecStart  = "${pkgs.strongswan}/sbin/ipsec start --nofork";

     

       150
       161
        
             };

     

       162
       162
       +
             preStart = ''

     

       163
       163
       +
               # with 'nopeerdns' setting, ppp writes into this folder

     

       164
       164
       +
               mkdir -m 700 -p /etc/ppp

     

       165
       165
       +
             '';

     

       151
       166
        
           };

     

       152
       167
        
         };

     

       153
       168
        
       }

+3

pkgs/tools/networking/network-manager/l2tp.nix

···

       22
       22
        
         postPatch = ''

     

       23
       23
        
           sed -i -e 's%"\(/usr/sbin\|/usr/pkg/sbin\|/usr/local/sbin\)/[^"]*",%%g' ./src/nm-l2tp-service.c

     

       24
       24
        
       

     

       25
       25
       +
           substituteInPlace ./Makefile.am \

     

       26
       26
       +
             --replace '$(sysconfdir)/dbus-1/system.d' "$out/etc/dbus-1/system.d"

     

       27
       27
       +
       

     

       25
       28
        
           substituteInPlace ./src/nm-l2tp-service.c \

     

       26
       29
        
             --replace /sbin/ipsec  ${strongswan}/bin/ipsec \

     

       27
       30
        
             --replace /sbin/xl2tpd ${xl2tpd}/bin/xl2tpd

+5

pkgs/tools/networking/strongswan/default.nix

···

       76
       76
        
                "--enable-sqlite" ]

     

       77
       77
        
           ++ optional enableNetworkManager "--enable-nm";

     

       78
       78
        
       

     

       79
       79
       +
         postInstall = ''

     

       80
       80
       +
           # this is needed for l2tp

     

       81
       81
       +
           echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets

     

       82
       82
       +
         '';

     

       83
       83
       +
       

     

       79
       84
        
         NIX_LDFLAGS = "-lgcc_s" ;

     

       80
       85
        
       

     

       81
       86
        
         meta = {