]> Git — Sourcephile - sourcephile-nix.git/blob - hosts/losurdo/networking/openvpn/riseup.nix
openvpn: switch to Riseup's Bitmask VPN; Riseup's VPNRED has been decommissioned...
[sourcephile-nix.git] / hosts / losurdo / networking / openvpn / riseup.nix
1 { pkgs, lib, config, ... }:
2 let
3 netns = "riseup";
4 inherit (config.services) openvpn;
5 apiUrl = "https://api.black.riseup.net/3/cert";
6 ca = pkgs.fetchurl {
7 url = "https://black.riseup.net/ca.crt";
8 hash = "sha256-Zdvnfz2k7iWlbgmmcUJrpJZ1dp7o0qXeJhP0HWJD7ro=";
9 } + "";
10 key-cert = "/run/openvpn-${netns}/key+cert.pem";
11 in
12 {
13 services.openvpn.servers.${netns} = {
14 inherit netns;
15 settings = {
16 remote =
17 # amsterdam
18 ["212.83.182.127" "212.83.165.160" "212.129.4.141"] ++
19 # paris
20 #["212.83.146.228" "212.83.143.67" "163.172.126.44"] ++
21 # miami
22 ["37.218.244.249" "37.218.244.251"] ++
23 # montreal
24 ["199.58.83.10" "199.58.83.10" "199.58.83.12"] ++
25 # new-york
26 ["185.220.103.12"] ++
27 # seattle
28 ["198.252.153.28" "198.252.153.28"] ++
29 [];
30 remote-random = true;
31 port = "443";
32 proto = "tcp";
33 inherit ca;
34 key = key-cert;
35 cert = key-cert;
36
37 auth = "SHA1";
38 cipher = "AES-128-CBC";
39 client = true;
40 dev = "ov-${netns}";
41 dev-type = "tun";
42 keepalive = "10 30";
43 nobind = true;
44 persist-key = true;
45 persist-tun = true;
46 remote-cert-tls = "server";
47 reneg-sec = 0;
48 script-security = 2;
49 tls-cipher = "DHE-RSA-AES128-SHA";
50 tls-client = true;
51 tun-ipv6 = true;
52 up-restart = true;
53 verb = 3;
54 };
55 };
56 systemd.services."openvpn-${netns}" = {
57 preStart = ''
58 set -e
59 ${pkgs.curl}/bin/curl -X POST --cacert ${ca} -o ${key-cert} -Ls ${apiUrl}
60 chmod 700 ${key-cert}
61 '';
62 serviceConfig = {
63 RuntimeDirectory = [ "openvpn-${netns}" ];
64 RuntimeDirectoryMode = "0700";
65 };
66 };
67 networking.nftables.ruleset = ''
68 add rule inet filter fw2net meta skuid root tcp dport 443 counter accept comment "OpenVPN Riseup"
69 '';
70 services.netns.namespaces.${netns} = {
71 nftables = lib.mkBefore ''
72 table inet filter {
73 include "${../../../../networking/nftables/filter.txt}"
74 chain input {
75 type filter hook input priority filter
76 policy drop
77 iifname lo accept
78 jump check-tcp
79 ct state { established, related } accept
80 jump accept-connectivity-input
81 jump check-broadcast
82 ct state invalid drop
83 }
84 chain forward {
85 type filter hook forward priority filter
86 policy drop
87 jump accept-connectivity-forward
88 }
89 chain output {
90 type filter hook output priority filter
91 policy drop
92 oifname lo accept
93 ct state { related, established } accept
94 jump accept-connectivity-output
95 }
96 }
97 '';
98 };
99 }