Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

OpenVPN: allow passing credentials with file #239268

Open
wants to merge 7 commits into
base: master
Choose a base branch
from
Open

OpenVPN: allow passing credentials with file #239268

Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
3e66b9b
move existing options out of config body
techhazard Jun 22, 2023
1601276
add option to use auth-user-pass with a file instead of putting crede…
techhazard Jun 22, 2023
83d50fe
remove randomly added P
techhazard Jun 23, 2023
20e35cc
move duplicate checks to new boolean variables
techhazard Jun 23, 2023
d0a72af
Merge branch 'NixOS:master' into openvpn-support-auth-file
techhazard Nov 12, 2024
856bee3
remove legacy markdown spec for description
techhazard Nov 12, 2024
3fcece8
use types.path for authUserPassFile
techhazard Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
36 changes: 26 additions & 10 deletions nixos/modules/services/networking/openvpn.nix
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -39,20 +39,30 @@ let
${cfg.down}
'';

hasUpScript = (cfg.up != "");
hasDownScript = (cfg.down != "");


upScriptOption = optionalString (hasUpScript || cfg.updateResolvConf) "up ${pkgs.writeShellScript "openvpn-${name}-up" upScript}";
downScriptOption = optionalString (hasDownScript || cfg.updateResolvConf) "down ${pkgs.writeShellScript "openvpn-${name}-down" downScript}";

authUserPassUnsafeOption = optionalString (cfg.authUserPass != null) "auth-user-pass ${pkgs.writeText "openvpn-credentials-${name}" ''
${cfg.authUserPass.username}
${cfg.authUserPass.password}
''}";

authUserPassFileOption = optionalString (cfg.authUserPassFile != null) "auth-user-pass ${cfg.authUserPassFile}";

authUserPassOption = if (authUserPassFileOption != "") then authUserPassFileOption else authUserPassUnsafeOption;
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

If you add an assertion that only one of these options can be set (i.e. cfg.authUserPass -> !cfg.authUserPassFile && cfg.authUserPassFile -> !cfg.authUserPass) you could just add both authUserPassUnsafeOption and authUserPassFileOption to the result, as at least one of them will always be an empty string


configFile = pkgs.writeText "openvpn-config-${name}"
''
errors-to-stderr
${optionalString (cfg.up != "" || cfg.down != "" || cfg.updateResolvConf) "script-security 2"}
${optionalString (hasUpScript || hasDownScript || cfg.updateResolvConf) "script-security 2"}
${cfg.config}
${optionalString (cfg.up != "" || cfg.updateResolvConf)
"up ${pkgs.writeShellScript "openvpn-${name}-up" upScript}"}
${optionalString (cfg.down != "" || cfg.updateResolvConf)
"down ${pkgs.writeShellScript "openvpn-${name}-down" downScript}"}
${optionalString (cfg.authUserPass != null)
"auth-user-pass ${pkgs.writeText "openvpn-credentials-${name}" ''
${cfg.authUserPass.username}
${cfg.authUserPass.password}
''}"}
${upScriptOption}
${downScriptOption}
${authUserPassOption}
'';

in
Expand Down Expand Up @@ -182,6 +192,12 @@ in
'';
};

authUserPassFile = mkOption {
default = null;
description = ''Specify a file path to use as `auth-user-pass ''${authUserPass}`. File will not be included in the nix store unless you specify it as a path `authUserFile = ./myauthfile`'';
type = types.nullOr types.path;
};

authUserPass = mkOption {
default = null;
description = ''
Expand Down