···

       
335
       
 
       


     

       
336
       
 
       
      preStart = ''

     

       
337
       
 
       
        mkdir -m 700 -p /etc/NetworkManager/system-connections

     

       
0
       
 
       

     

       
338
       
 
       
        mkdir -m 755 -p ${stateDirs}

     

       
339
       
 
       
      '';

     

       
340
       
 
       
    };

     

···

       
335
       
 
       


     

       
336
       
 
       
      preStart = ''

     

       
337
       
 
       
        mkdir -m 700 -p /etc/NetworkManager/system-connections

     

       
338
       
+
       
        mkdir -m 700 -p /etc/ipsec.d

     

       
339
       
 
       
        mkdir -m 755 -p ${stateDirs}

     

       
340
       
 
       
      '';

     

       
341
       
 
       
    };

     

···

       
32
       
 
       
      ${caConf}

     

       
33
       
 
       
    '';

     

       
34
       
 
       


     

       
35
       
-
       
  strongswanConf = {setup, connections, ca, secrets, managePlugins, enabledPlugins}: toFile "strongswan.conf" ''

     

       
36
       
 
       
    charon {

     

       
37
       
 
       
      ${if managePlugins then "load_modular = no" else ""}

     

       
38
       
 
       
      ${if managePlugins then ("load = " + (concatStringsSep " " enabledPlugins)) else ""}

     

       
39
       
 
       
      plugins {

     

       
40
       
 
       
        stroke {

     

       
41
       
-
       
          secrets_file = ${ipsecSecrets secrets}

     

       
42
       
 
       
        }

     

       
43
       
 
       
      }

     

       
44
       
 
       
    }

     
···

       
135
       
 
       
    };

     

       
136
       
 
       
  };

     

       
137
       
 
       


     

       
138
       
-
       
  config = with cfg; mkIf enable {

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
139
       
 
       
    systemd.services.strongswan = {

     

       
140
       
 
       
      description = "strongSwan IPSec Service";

     

       
141
       
 
       
      wantedBy = [ "multi-user.target" ];

     
···

       
143
       
 
       
      wants = [ "keys.target" ];

     

       
144
       
 
       
      after = [ "network-online.target" "keys.target" ];

     

       
145
       
 
       
      environment = {

     

       
146
       
-
       
        STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secrets managePlugins enabledPlugins; };

     

       
147
       
 
       
      };

     

       
148
       
 
       
      serviceConfig = {

     

       
149
       
 
       
        ExecStart  = "${pkgs.strongswan}/sbin/ipsec start --nofork";

     

       
150
       
 
       
      };

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
151
       
 
       
    };

     

       
152
       
 
       
  };

     

       
153
       
 
       
}

     

···

       
32
       
 
       
      ${caConf}

     

       
33
       
 
       
    '';

     

       
34
       
 
       


     

       
35
       
+
       
  strongswanConf = {setup, connections, ca, secretsFile, managePlugins, enabledPlugins}: toFile "strongswan.conf" ''

     

       
36
       
 
       
    charon {

     

       
37
       
 
       
      ${if managePlugins then "load_modular = no" else ""}

     

       
38
       
 
       
      ${if managePlugins then ("load = " + (concatStringsSep " " enabledPlugins)) else ""}

     

       
39
       
 
       
      plugins {

     

       
40
       
 
       
        stroke {

     

       
41
       
+
       
          secrets_file = ${secretsFile}

     

       
42
       
 
       
        }

     

       
43
       
 
       
      }

     

       
44
       
 
       
    }

     
···

       
135
       
 
       
    };

     

       
136
       
 
       
  };

     

       
137
       
 
       


     

       
138
       
+
       


     

       
139
       
+
       
  config = with cfg;

     

       
140
       
+
       
  let

     

       
141
       
+
       
    secretsFile = ipsecSecrets cfg.secrets;

     

       
142
       
+
       
  in

     

       
143
       
+
       
  mkIf enable

     

       
144
       
+
       
    {

     

       
145
       
+
       


     

       
146
       
+
       
    # here we should use the default strongswan ipsec.secrets and

     

       
147
       
+
       
    # append to it (default one is empty so not a pb for now)

     

       
148
       
+
       
    environment.etc."ipsec.secrets".source = secretsFile;

     

       
149
       
+
       


     

       
150
       
 
       
    systemd.services.strongswan = {

     

       
151
       
 
       
      description = "strongSwan IPSec Service";

     

       
152
       
 
       
      wantedBy = [ "multi-user.target" ];

     
···

       
154
       
 
       
      wants = [ "keys.target" ];

     

       
155
       
 
       
      after = [ "network-online.target" "keys.target" ];

     

       
156
       
 
       
      environment = {

     

       
157
       
+
       
        STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secretsFile managePlugins enabledPlugins; };

     

       
158
       
 
       
      };

     

       
159
       
 
       
      serviceConfig = {

     

       
160
       
 
       
        ExecStart  = "${pkgs.strongswan}/sbin/ipsec start --nofork";

     

       
161
       
 
       
      };

     

       
162
       
+
       
      preStart = ''

     

       
163
       
+
       
        # with 'nopeerdns' setting, ppp writes into this folder

     

       
164
       
+
       
        mkdir -m 700 -p /etc/ppp

     

       
165
       
+
       
      '';

     

       
166
       
 
       
    };

     

       
167
       
 
       
  };

     

       
168
       
 
       
}

     

···

       
22
       
 
       
  postPatch = ''

     

       
23
       
 
       
    sed -i -e 's%"\(/usr/sbin\|/usr/pkg/sbin\|/usr/local/sbin\)/[^"]*",%%g' ./src/nm-l2tp-service.c

     

       
24
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
25
       
 
       
    substituteInPlace ./src/nm-l2tp-service.c \

     

       
26
       
 
       
      --replace /sbin/ipsec  ${strongswan}/bin/ipsec \

     

       
27
       
 
       
      --replace /sbin/xl2tpd ${xl2tpd}/bin/xl2tpd

     

···

       
22
       
 
       
  postPatch = ''

     

       
23
       
 
       
    sed -i -e 's%"\(/usr/sbin\|/usr/pkg/sbin\|/usr/local/sbin\)/[^"]*",%%g' ./src/nm-l2tp-service.c

     

       
24
       
 
       


     

       
25
       
+
       
    substituteInPlace ./Makefile.am \

     

       
26
       
+
       
      --replace '$(sysconfdir)/dbus-1/system.d' "$out/etc/dbus-1/system.d"

     

       
27
       
+
       


     

       
28
       
 
       
    substituteInPlace ./src/nm-l2tp-service.c \

     

       
29
       
 
       
      --replace /sbin/ipsec  ${strongswan}/bin/ipsec \

     

       
30
       
 
       
      --replace /sbin/xl2tpd ${xl2tpd}/bin/xl2tpd

     

···

       
76
       
 
       
         "--enable-sqlite" ]

     

       
77
       
 
       
    ++ optional enableNetworkManager "--enable-nm";

     

       
78
       
 
       


     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
0
       
 
       

     

       
79
       
 
       
  NIX_LDFLAGS = "-lgcc_s" ;

     

       
80
       
 
       


     

       
81
       
 
       
  meta = {

     

···

       
76
       
 
       
         "--enable-sqlite" ]

     

       
77
       
 
       
    ++ optional enableNetworkManager "--enable-nm";

     

       
78
       
 
       


     

       
79
       
+
       
  postInstall = ''

     

       
80
       
+
       
    # this is needed for l2tp

     

       
81
       
+
       
    echo "include /etc/ipsec.secrets" >> $out/etc/ipsec.secrets

     

       
82
       
+
       
  '';

     

       
83
       
+
       


     

       
84
       
 
       
  NIX_LDFLAGS = "-lgcc_s" ;

     

       
85
       
 
       


     

       
86
       
 
       
  meta = {