nixpkgs/patches/openvpn.diff

   1 diff --git a/nixos/modules/module-list.nix b/nixos/modules/module-list.nix
   2 index e5f9c673c18..e331312bdb7 100644
   3 --- a/nixos/modules/module-list.nix
   4 +++ b/nixos/modules/module-list.nix
   5 @@ -862,6 +862,7 @@
   6    ./services/networking/ndppd.nix
   7    ./services/networking/nebula.nix
   8    ./services/networking/networkmanager.nix
   9 +  ./services/networking/netns.nix
  10    ./services/networking/nextdns.nix
  11    ./services/networking/nftables.nix
  12    ./services/networking/ngircd.nix
  13 diff --git a/nixos/modules/services/networking/netns.nix b/nixos/modules/services/networking/netns.nix
  14 new file mode 100644
  15 index 00000000000..2e62738089d
  16 --- /dev/null
  17 +++ b/nixos/modules/services/networking/netns.nix
  18 @@ -0,0 +1,106 @@
  19 +{ pkgs, lib, config, options, ... }:
  20 +with lib;
  21 +let
  22 +  cfg = config.services.netns;
  23 +  inherit (config) networking;
  24 +  # Escape as required by: https://www.freedesktop.org/software/systemd/man/systemd.unit.html
  25 +  escapeUnitName = name:
  26 +    lib.concatMapStrings (s: if lib.isList s then "-" else s)
  27 +    (builtins.split "[^a-zA-Z0-9_.\\-]+" name);
  28 +in
  29 +{
  30 +options.services.netns = {
  31 +  namespaces = mkOption {
  32 +    description = ''
  33 +      Network namespaces to create.
  34 +
  35 +      Other services can join a network namespace named <code>netns</code> with:
  36 +      <screen>
  37 +      PrivateNetwork=true;
  38 +      JoinsNamespaceOf="netns-''${netns}.service";
  39 +      </screen>
  40 +
  41 +      So can <literal>iproute</literal> with:
  42 +      <code>ip -n ''${netns}</code>
  43 +
  44 +      <warning><para>
  45 +      You should usually create (or update via your VPN configuration's up script)
  46 +      a file named <literal>/etc/netns/''${netns}/resolv.conf</literal>
  47 +      that will be bind-mounted by <code>ip -n ''${netns}</code> onto <literal>/etc/resolv.conf</literal>,
  48 +      which you'll also want to configure in the services joining this network namespace:
  49 +      <screen>
  50 +      BindReadOnlyPaths = ["/etc/netns/''${netns}/resolv.conf:/etc/resolv.conf"];
  51 +      </screen>
  52 +      </para></warning>
  53 +    '';
  54 +    default = {};
  55 +    type = types.attrsOf (types.submodule {
  56 +      options.nftables = mkOption {
  57 +        description = "Nftables ruleset within the network namespace.";
  58 +        type = types.lines;
  59 +        default = networking.nftables.ruleset;
  60 +        defaultText = "config.networking.nftables.ruleset";
  61 +      };
  62 +      options.sysctl = options.boot.kernel.sysctl // {
  63 +        description = "sysctl within the network namespace.";
  64 +        default = config.boot.kernel.sysctl;
  65 +        defaultText = "config.boot.kernel.sysctl";
  66 +      };
  67 +      options.service = mkOption {
  68 +        description = "Systemd configuration specific to this netns service";
  69 +        type = types.attrs;
  70 +        default = {};
  71 +      };
  72 +    });
  73 +  };
  74 +};
  75 +config = {
  76 +  systemd.services = mapAttrs' (name: c:
  77 +    nameValuePair "netns-${escapeUnitName name}" (mkMerge [
  78 +      { description = "${name} network namespace";
  79 +        before = [ "network.target" ];
  80 +        serviceConfig = {
  81 +          Type = "oneshot";
  82 +          RemainAfterExit = true;
  83 +          # Let systemd create the netns so that PrivateNetwork=true
  84 +          # with JoinsNamespaceOf="netns-${name}.service" works.
  85 +          PrivateNetwork = true;
  86 +          ExecStart = [
  87 +            # For convenience, register the netns to the tracking mecanism of iproute,
  88 +            # and make sure resolv.conf can be used in BindReadOnlyPaths=
  89 +            # For propagating changes in that file to the services bind mounting it,
  90 +            # updating must not remove the file, but only truncate it.
  91 +            (pkgs.writeShellScript "ip-netns-attach" ''
  92 +              ${pkgs.iproute}/bin/ip netns attach ${escapeShellArg name} $$
  93 +              mkdir -p /etc/netns/${escapeShellArg name}
  94 +              touch /etc/netns/${escapeShellArg name}/resolv.conf
  95 +            '')
  96 +
  97 +            # Bringing the loopback interface is almost always a good thing.
  98 +            "${pkgs.iproute}/bin/ip link set dev lo up"
  99 +
 100 +            # Use --ignore because some keys may no longer exist in that new namespace,
 101 +            # like net.ipv6.conf.eth0.addr_gen_mode or net.core.rmem_max
 102 +            ''${pkgs.procps}/bin/sysctl --ignore -p ${pkgs.writeScript "sysctl"
 103 +              (concatStrings (mapAttrsToList (n: v:
 104 +                optionalString (v != null)
 105 +                  "${n}=${if v == false then "0" else toString v}\n"
 106 +                ) c.sysctl))}
 107 +            ''
 108 +          ] ++
 109 +          # Load the nftables ruleset of this netns.
 110 +          optional networking.nftables.enable (pkgs.writeScript "nftables-ruleset" ''
 111 +            #!${pkgs.nftables}/bin/nft -f
 112 +            flush ruleset
 113 +            ${c.nftables}
 114 +          '');
 115 +          # Unregister the netns from the tracking mecanism of iproute.
 116 +          ExecStop = "${pkgs.iproute}/bin/ip netns delete ${escapeShellArg name}";
 117 +        };
 118 +      }
 119 +      c.service
 120 +    ]
 121 +    )) cfg.namespaces;
 122 +  meta.maintainers = with lib.maintainers; [ julm ];
 123 +};
 124 +}
 125 diff --git a/nixos/modules/services/networking/openvpn.nix b/nixos/modules/services/networking/openvpn.nix
 126 index 492a0936fdb..adb1c8b5f0d 100644
 127 --- a/nixos/modules/services/networking/openvpn.nix
 128 +++ b/nixos/modules/services/networking/openvpn.nix
 129 @@ -5,71 +5,216 @@ with lib;
 130  let
 131
 132    cfg = config.services.openvpn;
 133 +  enabledServers = filterAttrs (name: srv: srv.enable) cfg.servers;
 134
 135    inherit (pkgs) openvpn;
 136
 137 +  PATH = name: makeBinPath config.systemd.services."openvpn-${name}".path;
 138 +
 139    makeOpenVPNJob = cfg: name:
 140      let
 141
 142 -      path = makeBinPath (getAttr "openvpn-${name}" config.systemd.services).path;
 143 +      configFile = pkgs.writeText "openvpn-config-${name}" (
 144 +        generators.toKeyValue {
 145 +          mkKeyValue = key: value:
 146 +            if hasAttr key scripts
 147 +            then "${key} " + pkgs.writeShellScript "openvpn-${name}-${key}" (scripts.${key} value)
 148 +            else if builtins.isBool value
 149 +            then optionalString value key
 150 +            else if builtins.isPath value
 151 +            then "${key} ${value}"
 152 +            else if builtins.isList value
 153 +            then concatMapStringsSep "\n" (v: "${key} ${generators.mkValueStringDefault {} v}") value
 154 +            else "${key} ${generators.mkValueStringDefault {} value}";
 155 +        } cfg.settings
 156 +      );
 157
 158 -      upScript = ''
 159 -        #! /bin/sh
 160 -        export PATH=${path}
 161 +      scripts = {
 162 +        up = script:
 163 +          let init = ''
 164 +            export PATH=${PATH name}
 165
 166 -        # For convenience in client scripts, extract the remote domain
 167 -        # name and name server.
 168 -        for var in ''${!foreign_option_*}; do
 169 -          x=(''${!var})
 170 -          if [ "''${x[0]}" = dhcp-option ]; then
 171 -            if [ "''${x[1]}" = DOMAIN ]; then domain="''${x[2]}"
 172 -            elif [ "''${x[1]}" = DNS ]; then nameserver="''${x[2]}"
 173 -            fi
 174 -          fi
 175 -        done
 176 +            # For convenience in client scripts, extract the remote domain
 177 +            # name and name server.
 178 +            for var in ''${!foreign_option_*}; do
 179 +              x=(''${!var})
 180 +              if [ "''${x[0]}" = dhcp-option ]; then
 181 +                if [ "''${x[1]}" = DOMAIN ]; then domain="''${x[2]}"
 182 +                elif [ "''${x[1]}" = DNS ]; then nameserver="''${x[2]}"
 183 +                fi
 184 +              fi
 185 +            done
 186
 187 -        ${cfg.up}
 188 -        ${optionalString cfg.updateResolvConf
 189 -           "${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf"}
 190 -      '';
 191 +            ${optionalString cfg.updateResolvConf
 192 +               "${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf"}
 193 +          '';
 194 +          # Add DNS settings given in foreign DHCP options to the resolv.conf of the netns.
 195 +          # Note that JoinsNamespaceOf="netns-${cfg.netns}.service" will not
 196 +          # BindReadOnlyPaths=["/etc/netns/${cfg.netns}/resolv.conf:/etc/resolv.conf"];
 197 +          # this will have to be added in each service joining the namespace.
 198 +          setNetNSResolvConf = ''
 199 +            mkdir -p /etc/netns/${cfg.netns}
 200 +            # This file is normally created by netns-${cfg.netns}.service,
 201 +            # care must be taken to not delete it but to truncate it
 202 +            # in order to propagate the changes to bind-mounted versions.
 203 +            : > /etc/netns/${cfg.netns}/resolv.conf
 204 +            chmod 644 /etc/netns/${cfg.netns}/resolv.conf
 205 +            foreign_opt_domains=
 206 +            process_foreign_option () {
 207 +              case "$1:$2" in
 208 +                dhcp-option:DNS) echo "nameserver $3" >>/etc/netns/'${cfg.netns}'/resolv.conf ;;
 209 +                dhcp-option:DOMAIN) foreign_opt_domains="$foreign_opt_domains $3" ;;
 210 +              esac
 211 +            }
 212 +            i=1
 213 +            while
 214 +              eval opt=\"\''${foreign_option_$i-}\"
 215 +              [ -n "$opt" ]
 216 +            do
 217 +              process_foreign_option $opt
 218 +              i=$(( i + 1 ))
 219 +            done
 220 +            for d in $foreign_opt_domains; do
 221 +              printf '%s\n' "domain $1" "search $*" \
 222 +                >>/etc/netns/'${cfg.netns}'/resolv.conf
 223 +            done
 224 +          '';
 225 +          in
 226 +          if cfg.netns == null
 227 +          then ''
 228 +            ${init}
 229 +            ${script}
 230 +          ''
 231 +          else ''
 232 +            export PATH=${PATH name}
 233 +            set -eux
 234 +            ${setNetNSResolvConf}
 235 +            ip link set dev '${cfg.settings.dev}' up netns '${cfg.netns}' mtu "$tun_mtu"
 236 +            ip netns exec '${cfg.netns}' ${pkgs.writeShellScript "openvpn-${name}-up-netns.sh" ''
 237 +              ${init}
 238 +              set -eux
 239 +              export PATH=${PATH name}
 240
 241 -      downScript = ''
 242 -        #! /bin/sh
 243 -        export PATH=${path}
 244 -        ${optionalString cfg.updateResolvConf
 245 -           "${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf"}
 246 -        ${cfg.down}
 247 -      '';
 248 +              ip link set dev lo up
 249
 250 -      configFile = pkgs.writeText "openvpn-config-${name}"
 251 -        ''
 252 -          errors-to-stderr
 253 -          ${optionalString (cfg.up != "" || cfg.down != "" || cfg.updateResolvConf) "script-security 2"}
 254 -          ${cfg.config}
 255 -          ${optionalString (cfg.up != "" || cfg.updateResolvConf)
 256 -              "up ${pkgs.writeScript "openvpn-${name}-up" upScript}"}
 257 -          ${optionalString (cfg.down != "" || cfg.updateResolvConf)
 258 -              "down ${pkgs.writeScript "openvpn-${name}-down" downScript}"}
 259 -          ${optionalString (cfg.authUserPass != null)
 260 -              "auth-user-pass ${pkgs.writeText "openvpn-credentials-${name}" ''
 261 -                ${cfg.authUserPass.username}
 262 -                ${cfg.authUserPass.password}
 263 -              ''}"}
 264 -        '';
 265 +              netmask4="''${ifconfig_netmask:-30}"
 266 +              netbits6="''${ifconfig_ipv6_netbits:-112}"
 267 +              if [ -n "''${ifconfig_local-}" ]; then
 268 +                if [ -n "''${ifconfig_remote-}" ]; then
 269 +                  ip -4 addr replace \
 270 +                    local "$ifconfig_local" \
 271 +                    peer "$ifconfig_remote/$netmask4" \
 272 +                    ''${ifconfig_broadcast:+broadcast "$ifconfig_broadcast"} \
 273 +                    dev '${cfg.settings.dev}'
 274 +                else
 275 +                  ip -4 addr replace \
 276 +                    local "$ifconfig_local/$netmask4" \
 277 +                    ''${ifconfig_broadcast:+broadcast "$ifconfig_broadcast"} \
 278 +                    dev '${cfg.settings.dev}'
 279 +                fi
 280 +              fi
 281 +              if [ -n "''${ifconfig_ipv6_local-}" ]; then
 282 +                if [ -n "''${ifconfig_ipv6_remote-}" ]; then
 283 +                  ip -6 addr replace \
 284 +                    local "$ifconfig_ipv6_local" \
 285 +                    peer "$ifconfig_ipv6_remote/$netbits6" \
 286 +                    dev '${cfg.settings.dev}'
 287 +                else
 288 +                  ip -6 addr replace \
 289 +                    local "$ifconfig_ipv6_local/$netbits6" \
 290 +                    dev '${cfg.settings.dev}'
 291 +                fi
 292 +              fi
 293 +              set +eux
 294 +              ${script}
 295 +            ''}
 296 +          '';
 297 +        route-up = script:
 298 +          if cfg.netns == null
 299 +          then script
 300 +          else ''
 301 +            export PATH=${PATH name}
 302 +            set -eux
 303 +            ip netns exec '${cfg.netns}' ${pkgs.writeShellScript "openvpn-${name}-route-up-netns" ''
 304 +              export PATH=${PATH name}
 305 +              set -eux
 306 +              i=1
 307 +              while
 308 +                eval net=\"\''${route_network_$i-}\"
 309 +                eval mask=\"\''${route_netmask_$i-}\"
 310 +                eval gw=\"\''${route_gateway_$i-}\"
 311 +                eval mtr=\"\''${route_metric_$i-}\"
 312 +                [ -n "$net" ]
 313 +              do
 314 +                ip -4 route replace "$net/$mask" via "$gw" ''${mtr:+metric "$mtr"}
 315 +                i=$(( i + 1 ))
 316 +              done
 317 +
 318 +              if [ -n "''${route_vpn_gateway-}" ]; then
 319 +                ip -4 route replace default via "$route_vpn_gateway"
 320 +              fi
 321 +
 322 +              i=1
 323 +              while
 324 +                # There doesn't seem to be $route_ipv6_metric_<n>
 325 +                # according to the manpage.
 326 +                eval net=\"\''${route_ipv6_network_$i-}\"
 327 +                eval gw=\"\''${route_ipv6_gateway_$i-}\"
 328 +                [ -n "$net" ]
 329 +              do
 330 +                ip -6 route replace  "$net"  via "$gw"  metric 100
 331 +                i=$(( i + 1 ))
 332 +              done
 333 +
 334 +              # There's no $route_vpn_gateway for IPv6. It's not
 335 +              # documented if OpenVPN includes default route in
 336 +              # $route_ipv6_*. Set default route to remote VPN
 337 +              # endpoint address if there is one. Use higher metric
 338 +              # than $route_ipv6_* routes to give preference to a
 339 +              # possible default route in them.
 340 +              if [ -n "''${ifconfig_ipv6_remote-}" ]; then
 341 +                ip -6 route replace default \
 342 +                  via "$ifconfig_ipv6_remote" metric 200
 343 +              fi
 344 +              ${script}
 345 +            ''}
 346 +          '';
 347 +        down = script:
 348 +          let init = ''
 349 +            export PATH=${PATH name}
 350 +            ${optionalString cfg.updateResolvConf
 351 +               "${pkgs.update-resolv-conf}/libexec/openvpn/update-resolv-conf"}
 352 +          ''; in
 353 +          if cfg.netns == null
 354 +          then ''
 355 +            ${init}
 356 +            ${script}
 357 +          ''
 358 +          else ''
 359 +            export PATH=${PATH name}
 360 +            ip netns exec '${cfg.netns}' ${pkgs.writeShellScript "openvpn-${name}-down-netns.sh" ''
 361 +              ${init}
 362 +              ${script}
 363 +            ''}
 364 +            rm -f /etc/netns/'${cfg.netns}'/resolv.conf
 365 +          '';
 366 +      };
 367
 368      in {
 369        description = "OpenVPN instance ‘${name}’";
 370
 371        wantedBy = optional cfg.autoStart "multi-user.target";
 372        after = [ "network.target" ];
 373 +      bindsTo = optional (cfg.netns != null) "netns-${cfg.netns}.service";
 374 +      requires = optional (cfg.netns != null) "netns-${cfg.netns}.service";
 375
 376        path = [ pkgs.iptables pkgs.iproute2 pkgs.nettools ];
 377
 378        serviceConfig.ExecStart = "@${openvpn}/sbin/openvpn openvpn --suppress-timestamps --config ${configFile}";
 379        serviceConfig.Restart = "always";
 380 +      serviceConfig.RestartSec = "5s";
 381        serviceConfig.Type = "notify";
 382      };
 383 -
 384  in
 385
 386  {
 387 @@ -87,30 +232,30 @@ in
 388        example = literalExpression ''
 389          {
 390            server = {
 391 -            config = '''
 392 +            settings = {
 393                # Simplest server configuration: https://community.openvpn.net/openvpn/wiki/StaticKeyMiniHowto
 394                # server :
 395 -              dev tun
 396 -              ifconfig 10.8.0.1 10.8.0.2
 397 -              secret /root/static.key
 398 -            ''';
 399 -            up = "ip route add ...";
 400 -            down = "ip route del ...";
 401 +              dev = "tun";
 402 +              ifconfig = "10.8.0.1 10.8.0.2";
 403 +              secret = "/root/static.key";
 404 +              up = "ip route add ...";
 405 +              down = "ip route del ...";
 406 +            };
 407            };
 408
 409            client = {
 410 -            config = '''
 411 -              client
 412 -              remote vpn.example.org
 413 -              dev tun
 414 -              proto tcp-client
 415 -              port 8080
 416 -              ca /root/.vpn/ca.crt
 417 -              cert /root/.vpn/alice.crt
 418 -              key /root/.vpn/alice.key
 419 -            ''';
 420 -            up = "echo nameserver $nameserver | ''${pkgs.openresolv}/sbin/resolvconf -m 0 -a $dev";
 421 -            down = "''${pkgs.openresolv}/sbin/resolvconf -d $dev";
 422 +            settings = {
 423 +              client = true;
 424 +              remote = "vpn.example.org";
 425 +              dev = "tun";
 426 +              proto = "tcp-client";
 427 +              port = 8080;
 428 +              ca = "/root/.vpn/ca.crt";
 429 +              cert = "/root/.vpn/alice.crt";
 430 +              key = "/root/.vpn/alice.key";
 431 +              up = "echo nameserver $nameserver | ''${pkgs.openresolv}/sbin/resolvconf -m 0 -a $dev";
 432 +              down = "''${pkgs.openresolv}/sbin/resolvconf -d $dev";
 433 +            };
 434            };
 435          }
 436        '';
 437 @@ -124,36 +269,77 @@ in
 438          attribute name.
 439        '';
 440
 441 -      type = with types; attrsOf (submodule {
 442 +      type = with types; attrsOf (submodule ({name, config, options, ...}: {
 443
 444 -        options = {
 445 +        options = rec {
 446 +          enable = mkEnableOption "OpenVPN server" // { default = true; };
 447
 448 -          config = mkOption {
 449 -            type = types.lines;
 450 +          settings = mkOption {
 451              description = lib.mdDoc ''
 452                Configuration of this OpenVPN instance.  See
 453                {manpage}`openvpn(8)`
 454                for details.
 455
 456                To import an external config file, use the following definition:
 457 -              `config = "config /path/to/config.ovpn"`
 458 -            '';
 459 -          };
 460 -
 461 -          up = mkOption {
 462 -            default = "";
 463 -            type = types.lines;
 464 -            description = lib.mdDoc ''
 465 -              Shell commands executed when the instance is starting.
 466 -            '';
 467 -          };
 468 -
 469 -          down = mkOption {
 470 -            default = "";
 471 -            type = types.lines;
 472 -            description = lib.mdDoc ''
 473 -              Shell commands executed when the instance is shutting down.
 474 +              <literal>config = /path/to/config.ovpn;</literal>
 475              '';
 476 +            default = {};
 477 +            type = types.submodule {
 478 +              freeformType = with types;
 479 +                attrsOf (
 480 +                  nullOr (
 481 +                    oneOf [
 482 +                      bool int str path
 483 +                      (listOf (oneOf [bool int str path]))
 484 +                    ]
 485 +                  )
 486 +                );
 487 +              options.dev = mkOption {
 488 +                default = null;
 489 +                type = types.str;
 490 +                description = lib.mkDoc ''
 491 +                  Shell commands executed when the instance is starting.
 492 +                '';
 493 +              };
 494 +              options.down = mkOption {
 495 +                default = "";
 496 +                type = types.lines;
 497 +                description = lib.mkDoc ''
 498 +                  Shell commands executed when the instance is shutting down.
 499 +                '';
 500 +              };
 501 +              options.errors-to-stderr = mkOption {
 502 +                default = true;
 503 +                type = types.bool;
 504 +                description = lib.mkDoc ''
 505 +                  Output errors to stderr instead of stdout
 506 +                  unless log output is redirected by one of the <code>--log</code> options.
 507 +                '';
 508 +              };
 509 +              options.route-up = mkOption {
 510 +                default = "";
 511 +                type = types.lines;
 512 +                description = lib.mkDoc ''
 513 +                  Run command after routes are added.
 514 +                '';
 515 +              };
 516 +              options.up = mkOption {
 517 +                default = "";
 518 +                type = types.lines;
 519 +                description = lib.mkDoc  ''
 520 +                  Shell commands executed when the instance is starting.
 521 +                '';
 522 +              };
 523 +              options.script-security = mkOption {
 524 +                default = 1;
 525 +                type = types.enum [1 2 3];
 526 +                description = lib.mkDoc ''
 527 +                  1 — (Default) Only call built-in executables such as ifconfig, ip, route, or netsh.
 528 +                  2 — Allow calling of built-in executables and user-defined scripts.
 529 +                  3 — Allow passwords to be passed to scripts via environmental variables (potentially unsafe).
 530 +                '';
 531 +              };
 532 +            };
 533            };
 534
 535            autoStart = mkOption {
 536 @@ -162,6 +348,10 @@ in
 537              description = lib.mdDoc "Whether this OpenVPN instance should be started automatically.";
 538            };
 539
 540 +          # Legacy options
 541 +          down = (elemAt settings.type.functor.payload.modules 0).options.down;
 542 +          up = (elemAt settings.type.functor.payload.modules 0).options.up;
 543 +
 544            updateResolvConf = mkOption {
 545              default = false;
 546              type = types.bool;
 547 @@ -195,9 +385,39 @@ in
 548                };
 549              });
 550            };
 551 +
 552 +          netns = mkOption {
 553 +            default = true;
 554 +            type = with types; nullOr str;
 555 +            description = lib.mkDoc "Network namespace.";
 556 +          };
 557          };
 558
 559 -      });
 560 +        config.settings = mkMerge
 561 +          [ (mkIf (config.netns != null) {
 562 +              # Useless to setup the interface
 563 +              # because moving it to the netns will reset it
 564 +              ifconfig-noexec = true;
 565 +              route-noexec = true;
 566 +              script-security = 2;
 567 +            })
 568 +            (mkIf (config.authUserPass != null) {
 569 +              auth-user-pass = pkgs.writeText "openvpn-auth-user-pass-${name}" ''
 570 +                ${config.authUserPass.username}
 571 +                ${config.authUserPass.password}
 572 +              '';
 573 +            })
 574 +            (mkIf config.updateResolvConf {
 575 +              script-security = 2;
 576 +            })
 577 +            { # Aliases legacy options
 578 +              down = mkAliasDefinitions (mkDefault options.down or { });
 579 +              up = mkAliasDefinitions (mkDefault options.up or { });
 580 +            }
 581 +          ];
 582 +
 583 +
 584 +      }));
 585
 586      };
 587
 588 @@ -206,9 +426,9 @@ in
 589
 590    ###### implementation
 591
 592 -  config = mkIf (cfg.servers != {}) {
 593 +  config = mkIf (enabledServers != {}) {
 594
 595 -    systemd.services = listToAttrs (mapAttrsFlatten (name: value: nameValuePair "openvpn-${name}" (makeOpenVPNJob value name)) cfg.servers);
 596 +    systemd.services = listToAttrs (mapAttrsFlatten (name: value: nameValuePair "openvpn-${name}" (makeOpenVPNJob value name)) enabledServers);
 597
 598      environment.systemPackages = [ openvpn ];
 599