colin/nixpkgs
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Merge pull request #264869 from h7x4/nixos-module-cleanup-quicktun

Browse Source 
nixos/quicktun: clean up module, add tests
This commit is contained in:
Franz Pletz 2023-12-15 20:14:39 +01:00 committed by GitHub
commit cbb38bf7b7
No known key found for this signature in database
GPG Key ID: 4AEE18F83AFDEB23
4 changed files with 125 additions and 46 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

146
nixos/modules/services/networking/quicktun.nix
View File

@ -1,94 +1,153 @@
{ config, pkgs, lib, ... }:
{ options, config, pkgs, lib, ... }:
let
inherit (lib) mkOption mdDoc types mkIf;
opt = options.services.quicktun;
cfg = config.services.quicktun;
in
with lib;
{
options = {
services.quicktun = mkOption {
default = { };
description = lib.mdDoc "QuickTun tunnels";
type = types.attrsOf (types.submodule {
description = mdDoc ''
QuickTun tunnels.
See <http://wiki.ucis.nl/QuickTun> for more information about available options.
'';
type = types.attrsOf (types.submodule ({ name, ... }: let
qtcfg = cfg.${name};
in {
options = {
tunMode = mkOption {
type = types.int;
default = 0;
example = 1;
description = lib.mdDoc "";
type = with types; coercedTo bool (b: if b then 1 else 0) (ints.between 0 1);
default = false;
example = true;
description = mdDoc "Whether to operate in tun (IP) or tap (Ethernet) mode.";
};
remoteAddress = mkOption {
type = types.str;
default = "0.0.0.0";
example = "tunnel.example.com";
description = lib.mdDoc "";
description = mdDoc ''
IP address or hostname of the remote end (use `0.0.0.0` for a floating/dynamic remote endpoint).
'';
};
localAddress = mkOption {
type = types.str;
type = with types; nullOr str;
default = null;
example = "0.0.0.0";
description = lib.mdDoc "";
description = mdDoc "IP address or hostname of the local end.";
};
localPort = mkOption {
type = types.int;
type = types.port;
default = 2998;
description = lib.mdDoc "";
description = mdDoc "Local UDP port.";
};
remotePort = mkOption {
type = types.int;
default = 2998;
description = lib.mdDoc "";
type = types.port;
default = qtcfg.localPort;
defaultText = lib.literalExpression "config.services.quicktun.<name>.localPort";
description = mdDoc " remote UDP port";
};
remoteFloat = mkOption {
type = types.int;
default = 0;
description = lib.mdDoc "";
type = with types; coercedTo bool (b: if b then 1 else 0) (ints.between 0 1);
default = false;
example = true;
description = mdDoc ''
Whether to allow the remote address and port to change when properly encrypted packets are received.
'';
};
protocol = mkOption {
type = types.str;
type = types.enum [ "raw" "nacl0" "nacltai" "salty" ];
default = "nacltai";
description = lib.mdDoc "";
description = mdDoc "Which protocol to use.";
};
privateKey = mkOption {
type = types.str;
description = lib.mdDoc "";
type = with types; nullOr str;
default = null;
description = mdDoc ''
Local secret key in hexadecimal form.
::: {.warning}
This option is deprecated. Please use {var}`services.quicktun.<name>.privateKeyFile` instead.
:::
::: {.note}
Not needed when {var}`services.quicktun.<name>.protocol` is set to `raw`.
:::
'';
};
privateKeyFile = mkOption {
type = with types; nullOr path;
# This is a hack to deprecate `privateKey` without using `mkChangedModuleOption`
default = if qtcfg.privateKey == null then null else pkgs.writeText "quickttun-key-${name}" qtcfg.privateKey;
defaultText = "null";
description = mdDoc ''
Path to file containing local secret key in binary or hexadecimal form.
::: {.note}
Not needed when {var}`services.quicktun.<name>.protocol` is set to `raw`.
:::
'';
};
publicKey = mkOption {
type = types.str;
description = lib.mdDoc "";
type = with types; nullOr str;
default = null;
description = mdDoc ''
Remote public key in hexadecimal form.
::: {.note}
Not needed when {var}`services.quicktun.<name>.protocol` is set to `raw`.
:::
'';
};
timeWindow = mkOption {
type = types.int;
type = types.ints.unsigned;
default = 5;
description = lib.mdDoc "";
description = mdDoc ''
Allowed time window for first received packet in seconds (positive number allows packets from history)
'';
};
upScript = mkOption {
type = types.lines;
default = "";
description = lib.mdDoc "";
type = with types; nullOr lines;
default = null;
description = mdDoc ''
Run specified command or script after the tunnel device has been opened.
'';
};
};
});
}));
};
};
config = mkIf (cfg != []) {
systemd.services = foldr (a: b: a // b) {} (
mapAttrsToList (name: qtcfg: {
config = {
warnings = lib.pipe cfg [
(lib.mapAttrsToList (name: value: if value.privateKey != null then name else null))
(builtins.filter (n: n != null))
(map (n: " - services.quicktun.${n}.privateKey"))
(services: lib.optional (services != [ ]) ''
`services.quicktun.<name>.privateKey` is deprecated.
Please use `services.quicktun.<name>.privateKeyFile` instead.
Offending options:
${lib.concatStringsSep "\n" services}
'')
];
systemd.services = lib.mkMerge (
lib.mapAttrsToList (name: qtcfg: {
"quicktun-${name}" = {
wantedBy = [ "multi-user.target" ];
after = [ "network.target" ];
@ -96,14 +155,14 @@ with lib;
INTERFACE = name;
TUN_MODE = toString qtcfg.tunMode;
REMOTE_ADDRESS = qtcfg.remoteAddress;
LOCAL_ADDRESS = qtcfg.localAddress;
LOCAL_ADDRESS = mkIf (qtcfg.localAddress != null) (qtcfg.localAddress);
LOCAL_PORT = toString qtcfg.localPort;
REMOTE_PORT = toString qtcfg.remotePort;
REMOTE_FLOAT = toString qtcfg.remoteFloat;
PRIVATE_KEY = qtcfg.privateKey;
PUBLIC_KEY = qtcfg.publicKey;
PRIVATE_KEY_FILE = mkIf (qtcfg.privateKeyFile != null) qtcfg.privateKeyFile;
PUBLIC_KEY = mkIf (qtcfg.publicKey != null) qtcfg.publicKey;
TIME_WINDOW = toString qtcfg.timeWindow;
TUN_UP_SCRIPT = pkgs.writeScript "quicktun-${name}-up.sh" qtcfg.upScript;
TUN_UP_SCRIPT = mkIf (qtcfg.upScript != null) (pkgs.writeScript "quicktun-${name}-up.sh" qtcfg.upScript);
SUID = "nobody";
};
serviceConfig = {
@ -114,5 +173,4 @@ with lib;
}) cfg
);
};
}

1
nixos/tests/all-tests.nix
View File

@ -717,6 +717,7 @@ in {
qgis-ltr = handleTest ./qgis.nix { qgisPackage = pkgs.qgis-ltr; };
qownnotes = handleTest ./qownnotes.nix {};
quake3 = handleTest ./quake3.nix {};
quicktun = handleTest ./quicktun.nix {};
quorum = handleTest ./quorum.nix {};
rabbitmq = handleTest ./rabbitmq.nix {};
radarr = handleTest ./radarr.nix {};

18
nixos/tests/quicktun.nix Normal file
View File

@ -0,0 +1,18 @@
import ./make-test-python.nix ({ pkgs, lib, ... }:
{
name = "quicktun";
meta.maintainers = with lib.maintainers; [ h7x4 ];
nodes = {
machine = { ... }: {
services.quicktun."test-tunnel" = {
protocol = "raw";
};
};
};
testScript = ''
start_all()
machine.wait_for_unit("quicktun-test-tunnel.service")
'';
})

6
pkgs/tools/networking/quicktun/default.nix
View File

@ -1,4 +1,4 @@
{ lib, stdenv, fetchFromGitHub, libsodium }:
{ lib, stdenv, fetchFromGitHub, libsodium, nixosTests }:
stdenv.mkDerivation {
pname = "quicktun";
@ -22,11 +22,13 @@ stdenv.mkDerivation {
install -vD out/quicktun* -t $out/bin
'';
passthru.tests.quicktun = nixosTests.quicktun;
meta = with lib; {
broken = stdenv.isDarwin;
description = "Very simple, yet secure VPN software";
homepage = "http://wiki.ucis.nl/QuickTun";
maintainers = [ ];
maintainers = with maintainers; [ h7x4 ];
platforms = platforms.unix;
license = licenses.bsd2;
};