nixos/profiles/openvpn/calyx.nix

   1 { pkgs, lib, config, ... }:
   2 let
   3   netns = "calyx";
   4   inherit (config.services) openvpn;
   5   apiUrl = "https://api.calyx.net:4430/3/cert";
   6   ca = pkgs.fetchurl
   7     {
   8       url = "https://calyx.net/ca.crt";
   9       hash = "sha256-zLs7TRXrHlPjqdaBN1cmbB062XhKs4cv5ajmrkg4O8s=";
  10       curlOptsList = [ "-k" ];
  11     } + "";
  12   key-cert = "/run/openvpn-${netns}/key+cert.pem";
  13 in
  14 {
  15   services.openvpn.servers.${netns} = {
  16     inherit netns;
  17     settings = {
  18       remote =
  19         # new-york (vpn2.calyx.net)
  20         [ "162.247.72.193" ] ++
  21         [ ];
  22       remote-random = true;
  23       port = "443";
  24       proto = "tcp";
  25       inherit ca;
  26       key = key-cert;
  27       cert = key-cert;
  28
  29       auth = "SHA1";
  30       client = true;
  31       dev = "ov-${netns}";
  32       dev-type = "tun";
  33       keepalive = "10 30";
  34       nobind = true;
  35       persist-key = true;
  36       persist-tun = true;
  37       remote-cert-tls = "server";
  38       reneg-sec = 0;
  39       script-security = 2;
  40       tls-cipher = "TLS-DHE-RSA-WITH-AES-128-CBC-SHA";
  41       tls-client = true;
  42       tun-ipv6 = true;
  43       up-restart = true;
  44       verb = 3;
  45     };
  46   };
  47   systemd.services."openvpn-${netns}" = {
  48     after = [ "network-online.target" ];
  49     preStart = ''
  50       (
  51       set -ex
  52       ${pkgs.curl}/bin/curl -X POST --cacert ${ca} -o ${key-cert} -vLs ${apiUrl}
  53       chmod 700 ${key-cert}
  54       )
  55     '';
  56     serviceConfig = {
  57       RuntimeDirectory = [ "openvpn-${netns}" ];
  58       RuntimeDirectoryMode = "0700";
  59     };
  60   };
  61   networking.nftables.ruleset = ''
  62     table inet filter {
  63       chain output-net {
  64         skuid root tcp dport https counter accept comment "OpenVPN Calyx"
  65         skuid root tcp dport 4430 counter accept comment "OpenVPN Calyx (API)"
  66       }
  67     }
  68   '';
  69   services.netns.namespaces.${netns} = {
  70     nftables = lib.mkBefore ''
  71       include "${../networking/nftables.txt}"
  72       table inet filter {
  73         chain output-lan {
  74           meta l4proto { udp, tcp } th dport domain counter accept comment "DNS"
  75           log prefix "calyx: output-lan: " counter drop
  76         }
  77         chain output-net {
  78           tcp dport { http, https } counter accept comment "HTTP"
  79           log prefix "calyx: output-net: " counter drop
  80         }
  81         chain output {
  82           ip daddr 10.0.0.0/8 counter goto output-lan
  83           ip daddr 172.16.0.0/12 counter goto output-lan
  84           ip daddr 192.168.0.0/16 counter goto output-lan
  85           ip daddr 224.0.0.0/3 counter goto output-lan
  86           jump output-net
  87           log prefix "calyx: output: " counter drop
  88         }
  89       }
  90     '';
  91   };
  92 }