diff options
| author | W. Kosior <koszko@koszko.org> | 2024-09-20 12:20:02 +0200 |
|---|---|---|
| committer | W. Kosior <koszko@koszko.org> | 2024-12-24 09:36:22 +0100 |
| commit | ce4f8829c74b086aef55eddd8b1a3b1aa0e32d75 (patch) | |
| tree | eec20eb06adbcb54dd1845b090ec299a28481670 /gnu | |
| parent | 942910028da77493b216f0dede02c1291f43ac1f (diff) | |
| download | guix-ce4f8829c74b086aef55eddd8b1a3b1aa0e32d75.tar.gz guix-ce4f8829c74b086aef55eddd8b1a3b1aa0e32d75.zip | |
services: openvpn: Allow client to pull DNS settings from server.
* gnu/services/vpn.scm (pull-dns?): New variable.
(serialize-pull-dns): New variable.
(make-up-down-config-options): New variable.
(make-script-security-cli-options): New variable.
(openvpn-client-configuration)[pull-dns?]: New field.
(openvpn-config-file): Serialize that field.
(openvpn-shepherd-service): Pass `--script-security' option to daemon.
Change-Id: I1141dd0b9bf5956f13cf1552c2718b0a7035fa86
Diffstat (limited to 'gnu')
| -rw-r--r-- | gnu/services/vpn.scm | 39 |
1 files changed, 35 insertions, 4 deletions
diff --git a/gnu/services/vpn.scm b/gnu/services/vpn.scm index 8e90032c93..71ab5bda1c 100644 --- a/gnu/services/vpn.scm +++ b/gnu/services/vpn.scm @@ -173,6 +173,27 @@ (format #t "resolv-retry infinite\n") #f)) +(define pull-dns? boolean?) +(define serialize-pull-dns empty-serializer) + +(define (make-up-down-config-options config) + (if (and (openvpn-client-configuration? config) + (openvpn-client-configuration-pull-dns? config)) + + #~(let ((openvpn #$(openvpn-client-configuration-openvpn config))) + (format #f "\ +up ~a/etc/openvpn/client.up +down ~a/etc/openvpn/client.down +" openvpn openvpn)) + + "")) + +(define (make-script-security-cli-options config) + (if (and (openvpn-client-configuration? config) + (openvpn-client-configuration-pull-dns? config)) + '("--script-security" "2") + '())) + (define (serialize-tls-auth role location) (if location (serialize-field 'tls-auth @@ -398,7 +419,11 @@ would be added to the store and readable by any user.") (remote (openvpn-remote-list '()) - "A list of remote servers to connect to.")) + "A list of remote servers to connect to.") + + (pull-dns? + (pull-dns #f) + "Install resolv.conf entries pulled from the server.")) ;; server-specific configuration ((tls-auth (tls-auth-server #f) @@ -481,7 +506,9 @@ is truncated and rewritten every minute.") ('server (display (string-append "client-config-dir " #$ccd-dir "\n") port)) - ('client (display "" port))))))))) + ('client (display #$(make-up-down-config-options + config) + port))))))))) (define (openvpn-shepherd-service role) (lambda (config) @@ -496,7 +523,11 @@ is truncated and rewritten every minute.") config)) (log-file (match role ('server "/var/log/openvpn-server.log") - ('client "/var/log/openvpn-client.log")))) + ('client "/var/log/openvpn-client.log"))) + (script-sec-opts (match role + ('server '()) + ('client (make-script-security-cli-options + config))))) (list (shepherd-service (documentation (string-append "Run the OpenVPN " (match role @@ -510,7 +541,7 @@ is truncated and rewritten every minute.") (start #~(make-forkexec-constructor (list (string-append #$openvpn "/sbin/openvpn") "--writepid" #$pid-file "--config" #$config-file - "--daemon") + #$@script-sec-opts "--daemon") #:pid-file #$pid-file #:log-file #$log-file)) (stop #~(make-kill-destructor))))))) |