From ea9c6fe8041faab128391a0c03ec3bde25e29fa3 Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Isma=C3=ABl=20Bouya?= Date: Thu, 13 Feb 2020 13:05:40 +0100 Subject: Add Tinc VPN --- modules/private/vpn/default.nix | 62 ++++++++++++++++++++++++++++++++++++++ modules/private/vpn/tinc/host-down | 7 +++++ modules/private/vpn/tinc/host-up | 11 +++++++ modules/private/vpn/tinc/tinc-down | 12 ++++++++ modules/private/vpn/tinc/tinc-up | 14 +++++++++ modules/private/vpn/tinc/tinc.conf | 11 +++++++ 6 files changed, 117 insertions(+) create mode 100644 modules/private/vpn/default.nix create mode 100755 modules/private/vpn/tinc/host-down create mode 100755 modules/private/vpn/tinc/host-up create mode 100755 modules/private/vpn/tinc/tinc-down create mode 100755 modules/private/vpn/tinc/tinc-up create mode 100644 modules/private/vpn/tinc/tinc.conf (limited to 'modules/private/vpn') diff --git a/modules/private/vpn/default.nix b/modules/private/vpn/default.nix new file mode 100644 index 0000000..fbcba2f --- /dev/null +++ b/modules/private/vpn/default.nix @@ -0,0 +1,62 @@ +{ config, pkgs, lib, ... }: +let + cfg = config.myServices.vpn; +in +{ + options.myServices = { + vpn.enable = lib.mkEnableOption "Enable vpn service"; + }; + + config = lib.mkIf cfg.enable { + secrets.keys = [ + { + dest = "tinc/key.priv"; + user = "root"; + group = "root"; + permissions = "0400"; + text = config.myEnv.vpn.eldiron.privateKey; + } + { + dest = "tinc/key.pub"; + user = "root"; + group = "root"; + permissions = "0400"; + text = config.myEnv.vpn.eldiron.publicKey; + } + ]; + networking.firewall.allowedTCPPorts = [ 655 1194 ]; + system.activationScripts.tinc = let + configFiles = pkgs.runCommand "tinc-files" { + mainInterface = "eth0"; + hostName = "ImmaeEu"; + network = "Immae"; + keyFile = config.secrets.fullPaths."tinc/key.priv"; + } '' + mkdir -p $out + for i in ${./tinc}/*; do + substituteAll $i $out/$(basename $i) + done + ''; + in '' + install -m750 -o root -g root -d /var/lib/tinc/ /var/lib/tinc/Immae + install -m700 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/{host-*,tinc-*} + install -m400 -o root -g root -t /var/lib/tinc/Immae ${configFiles}/tinc.conf + if [ ! -d /var/lib/tinc/Immae/hosts ]; then + ${pkgs.git}/bin/git clone -b master https://git.immae.eu/perso/Immae/Config/tinc/hosts /var/lib/tinc/Immae/hosts + fi + ''; + + systemd.services.tinc-Immae = { + description = "Tinc Daemon - Immae"; + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + path = [ pkgs.tinc pkgs.bashInteractive pkgs.iproute pkgs.gnused pkgs.gawk pkgs.git pkgs.glibc ]; + serviceConfig = { + Type = "simple"; + Restart = "always"; + RestartSec = "3"; + ExecStart = "${pkgs.tinc}/bin/tincd -d1 -D -c /var/lib/tinc/Immae --pidfile /run/tinc.Immae.pid"; + }; + }; + }; +} diff --git a/modules/private/vpn/tinc/host-down b/modules/private/vpn/tinc/host-down new file mode 100755 index 0000000..1e79bd3 --- /dev/null +++ b/modules/private/vpn/tinc/host-down @@ -0,0 +1,7 @@ +#!/usr/bin/env bash + +SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }') +NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '` +for NODEIP in $NODEIPS; do + ip neigh del proxy $NODEIP dev @mainInterface@ +done diff --git a/modules/private/vpn/tinc/host-up b/modules/private/vpn/tinc/host-up new file mode 100755 index 0000000..2f7cee2 --- /dev/null +++ b/modules/private/vpn/tinc/host-up @@ -0,0 +1,11 @@ +#!/usr/bin/env bash + +SUBDOMAIN=$(echo "$NODE" | sed -e "s/\([A-Z][a-z0-9]*\)/\L\1 /g;" | awk '{ for (i=NF; i>1; i--) printf("%s.",$i); print $1; }') +while [ -z "$NODEIPS" ]; do + NODEIPS=`getent hosts ${SUBDOMAIN}.immae.eu | cut -d' ' -f1 | tr "\\n" ' '` + sleep 5 +done +for NODEIP in $NODEIPS; do + ip neigh add proxy $NODEIP dev @mainInterface@ +done +(cd /var/lib/tinc/@network@/hosts && git pull -q origin master) || true diff --git a/modules/private/vpn/tinc/tinc-down b/modules/private/vpn/tinc/tinc-down new file mode 100755 index 0000000..1cc45c0 --- /dev/null +++ b/modules/private/vpn/tinc/tinc-down @@ -0,0 +1,12 @@ +#!/bin/sh +# This file closes down the tap device. + +echo 0 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp +echo 0 > /proc/sys/net/ipv6/conf/all/forwarding + +GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1` + +ip neigh del proxy $GWIP dev eth0 + +ip -6 addr del $GWIP/96 dev $INTERFACE +ip -6 link set $INTERFACE down diff --git a/modules/private/vpn/tinc/tinc-up b/modules/private/vpn/tinc/tinc-up new file mode 100755 index 0000000..26c1ec3 --- /dev/null +++ b/modules/private/vpn/tinc/tinc-up @@ -0,0 +1,14 @@ +#!/usr/bin/env bash + +echo 1 > /proc/sys/net/ipv6/conf/@mainInterface@/proxy_ndp +echo 1 > /proc/sys/net/ipv6/conf/all/forwarding + +SUBNET=`getent hosts sn.vpn.immae.eu | head -n1 | cut -d' ' -f1` +GWIP=`getent hosts gw.vpn.immae.eu | head -n1 | cut -d' ' -f1` + +ip -6 link set $INTERFACE up mtu 1280 txqueuelen 1000 + +ip -6 addr add $GWIP/96 dev $INTERFACE +ip -6 route add $SUBNET/80 dev $INTERFACE + +ip neigh add proxy $GWIP dev @mainInterface@ diff --git a/modules/private/vpn/tinc/tinc.conf b/modules/private/vpn/tinc/tinc.conf new file mode 100644 index 0000000..7a4f103 --- /dev/null +++ b/modules/private/vpn/tinc/tinc.conf @@ -0,0 +1,11 @@ +BindToAddress = * 655 +BindToAddress = * 1194 + +Name = @hostName@ +Interface = vpn6 + +Mode = switch + +Device = /dev/net/tun +GraphDumpFile = /var/lib/tinc/@network@/tinc_graph +PrivateKeyFile = @keyFile@ -- cgit v1.2.3