diff options
author | makefu <github@syntax-fehler.de> | 2017-12-18 21:26:45 +0100 |
---|---|---|
committer | makefu <github@syntax-fehler.de> | 2017-12-18 21:26:45 +0100 |
commit | 1d7247baeb08b5bea5e8412619d20f91b754c64d (patch) | |
tree | 6e4197c54c417d4cd1b39d925ecbe661614396e4 | |
parent | a0c44c41912f0a9ed65fd5a895f92819d33caa71 (diff) |
ma nginx: add vpn-ws prototype
-rw-r--r-- | 2configs/nginx/euer.blog.vpn.nix | 35 |
1 files changed, 35 insertions, 0 deletions
diff --git a/2configs/nginx/euer.blog.vpn.nix b/2configs/nginx/euer.blog.vpn.nix new file mode 100644 index 000000000..b3db0bc60 --- /dev/null +++ b/2configs/nginx/euer.blog.vpn.nix @@ -0,0 +1,35 @@ +{pkgs, options, ... }: +let + pkg = pkgs.vpn-ws; + uid = "nginx"; + gid = "nginx"; + ip = "${pkgs.iproute}/bin/ip"; +in { + services.nginx.virtualHosts."euer.krebsco.de".locations."/vpn" = { + # TODO client auth + extraConfig = '' + uwsgi_pass unix:/run/vpn.sock; + include ${pkgs.nginx}/conf/uwsgi_params; + ''; + }; + + networking.interfaces.vpnws = { + virtual = true; + virtualType = "tap"; + }; + systemd.services.vpnws = { + wantedBy = [ "multi-user.target" ]; + after = [ "network.target" ]; + serviceConfig = { + Restart = "always"; + PrivateTmp = true; + ExecStartPre = pkgs.writeDash "vpnws-pre" '' + ${ip} link set vpnws up + ${ip} addr add 10.244.1.1/24 dev vpnws || : + ''; + ExecStart = pkgs.writeDash "vpnws-start" '' + ${pkg}/bin/vpn-ws --tuntap vpnws /run/vpn.sock + ''; + }; + }; +} |