fabianhauser/dotfiles
1
0
Fork 0
Code Issues 4 Pull requests 1 Projects Releases Packages Wiki Activity Actions

Refactorings and cleanups

Browse source
This commit is contained in:
Fabian Hauser 2022-01-05 16:51:44 +01:00
parent 9ed4b18e1d
commit abe0ef7ad8
10 changed files with 28 additions and 141 deletions
Download patch file Download diff file Expand all files Collapse all files

1
defaults/user-configuration/fhauser/work/.gitignore vendored Normal file
View file

@ -0,0 +1 @@
openvpn.nix

4
defaults/user-configuration/fhauser/work/android-studio.nix
View file

@ -1,4 +0,0 @@
{ pkgs, ... }: {
programs.adb.enable = true;
users.users.fhauser.extraGroups = [ "adbusers" ];
}

4
defaults/user-configuration/fhauser/work/default.nix
View file

@ -1,6 +1,6 @@
{ config, pkgs, lib, ... }:
{
imports = [ ./android-studio.nix ./openvpn.nix ];
# Note: Some of these files might not be provided by this repository.
imports = [ ./openvpn.nix ];
}

91
defaults/user-configuration/fhauser/work/openvpn.nix
View file

@ -1,91 +0,0 @@
{ pkgs, lib, config, ... }: {
services.openvpn.servers.threema = let
cafile = pkgs.writeTextFile {
name = "threema-vpn-ca.crt";
text = ''
-----BEGIN CERTIFICATE-----
MIIDMjCCAhqgAwIBAgIJANmI9BYPseTxMA0GCSqGSIb3DQEBCwUAMBUxEzARBgNV
BAMMCk9wZW5WUE4gQ0EwHhcNMTkwNTE1MTQzOTM0WhcNMjkwNTEyMTQzOTM0WjAV
MRMwEQYDVQQDDApPcGVuVlBOIENBMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIB
CgKCAQEA7NaiObgz2L5wmGIgOWUe1n6Q1g6Y5CYsrMQI8yhIDqKSx0fTL9eT2hvn
zThnltxKJRVTn0qGPf/7QF6WzjIXfKSJH5Cb+OKgYmqfRI2TW+ncqyJCaa3Fl9lI
VgU4knro6Cp9dhNhrNmRoRFvZ/17noB4+WPds7EgRObDi2ERuwAbONgz56J2Rea6
RHVL6HMFY7v8Zp8B/MnzSba/OSJC7RXCuCs6qNOgJOoHnp5PnsB3V40mszy4h/0Q
jVbBdZ3K4rEjNiawhCOetXhgHSaVGH4MP5oWrAN4UiI+IIfz6Ywz5mc7F6yBZa/e
aCG+r2bMUIepVPE25AUfuZ6O8+0+iwIDAQABo4GEMIGBMB0GA1UdDgQWBBQDHenu
05GGgcztJ1FCUWQlbYxGLjBFBgNVHSMEPjA8gBQDHenu05GGgcztJ1FCUWQlbYxG
LqEZpBcwFTETMBEGA1UEAwwKT3BlblZQTiBDQYIJANmI9BYPseTxMAwGA1UdEwQF
MAMBAf8wCwYDVR0PBAQDAgEGMA0GCSqGSIb3DQEBCwUAA4IBAQDTQtMeER20/3r/
Zn+IRpIEJh/ITxEE6kKCKo59wwVEFA0Ba+7d+BslFTCPhADM2p0AzPt5OSEo0A2N
nWGL3hhBPcnrBTFUma58gGz++v5Oy8GpfaCoXjCqfANjAbApY0JCCSWb1BJWkhXt
vDMlVXv6UzfF4HCeEQCof4QcW8ca4csrOceW76S7Cc3Or4iyTXKQrZ5PKy081CfV
sTLgGMQX4kZT9MBg13wDj0WkdJaWxQ2C73/me/YypcctN7t1wy7pUx33rEE1xh/o
9fsKcFs0qqYKRUY8AnghhuimBrkHoqUcdrG/6WO7+hbipxIDStm4Qbnptde3fhJT
rGUhGexA
-----END CERTIFICATE-----
'';
};
dhcpIps = [ "185.88.236.100" "212.103.68.20" ];
dhcpOptions = with builtins;
concatStringsSep "\n" (map (ip: "dhcp-option DNS ${ip}") dhcpIps);
in {
autoStart = false;
config = ''
remote vpn.threema.ch 38417 tcp-client
remote 5.148.189.116 38417 tcp-client
remote 178.209.63.8 38417 tcp-client
nobind
dev tun
persist-tun
persist-key
pull
auth-user-pass
tls-client
ca ${cafile}
remote-cert-tls server
route 10.83.0.0 255.255.0.0 default default
route 10.90.0.0 255.255.0.0 default default
route 192.168.11.0 255.255.255.0 default default
route 192.168.13.0 255.255.255.0 default default
route 136.243.104.147 255.255.255.255 default default
route 188.126.81.131 255.255.255.255 default default
route 95.211.228.137 255.255.255.255 default default
route 185.88.236.64 255.255.255.192 default default
route 212.103.68.0 255.255.255.192 default default
route 194.56.189.145 255.255.255.255 default default
route 54.38.37.213 255.255.255.255 default default
# VPN exclusions: Jitsi and TURN
route 185.88.236.76 255.255.255.255 net_gateway default
route 185.88.236.77 255.255.255.255 net_gateway default
route 185.88.236.98 255.255.255.255 net_gateway default
route 185.88.236.113 255.255.255.255 net_gateway default
route 185.88.236.114 255.255.255.255 net_gateway default
route 212.103.68.7 255.255.255.255 net_gateway default
route 212.103.68.8 255.255.255.255 net_gateway default
route 212.103.68.40 255.255.255.255 net_gateway default
route 212.103.68.41 255.255.255.255 net_gateway default
${dhcpOptions}
#dhcp-option DOMAIN-ROUTE threema.ch
reneg-bytes 0
auth-nocache
tls-cipher DEFAULT
reneg-sec 0
cipher AES-128-CBC
data-ciphers AES-128-CBC
data-ciphers-fallback AES-128-CBC
remap-usr1 SIGTERM
#script-security 2
#up ${pkgs.update-systemd-resolved}/libexec/openvpn/update-systemd-resolved
#up-restart
#down ${pkgs.update-systemd-resolved}/libexec/openvpn/update-systemd-resolved
#down-pre
'';
updateResolvConf = true;
};
systemd.services.openvpn-threema.serviceConfig.Restart = lib.mkForce "no";
}