diff options
| -rw-r--r-- | gnu/services/vpn.scm | 39 |
1 files changed, 35 insertions, 4 deletions
diff --git a/gnu/services/vpn.scm b/gnu/services/vpn.scm index 8e90032c93..71ab5bda1c 100644 --- a/gnu/services/vpn.scm +++ b/gnu/services/vpn.scm @@ -173,6 +173,27 @@ (format #t "resolv-retry infinite\n") #f)) +(define pull-dns? boolean?) +(define serialize-pull-dns empty-serializer) + +(define (make-up-down-config-options config) + (if (and (openvpn-client-configuration? config) + (openvpn-client-configuration-pull-dns? config)) + + #~(let ((openvpn #$(openvpn-client-configuration-openvpn config))) + (format #f "\ +up ~a/etc/openvpn/client.up +down ~a/etc/openvpn/client.down +" openvpn openvpn)) + + "")) + +(define (make-script-security-cli-options config) + (if (and (openvpn-client-configuration? config) + (openvpn-client-configuration-pull-dns? config)) + '("--script-security" "2") + '())) + (define (serialize-tls-auth role location) (if location (serialize-field 'tls-auth @@ -398,7 +419,11 @@ would be added to the store and readable by any user.") (remote (openvpn-remote-list '()) - "A list of remote servers to connect to.")) + "A list of remote servers to connect to.") + + (pull-dns? + (pull-dns #f) + "Install resolv.conf entries pulled from the server.")) ;; server-specific configuration ((tls-auth (tls-auth-server #f) @@ -481,7 +506,9 @@ is truncated and rewritten every minute.") ('server (display (string-append "client-config-dir " #$ccd-dir "\n") port)) - ('client (display "" port))))))))) + ('client (display #$(make-up-down-config-options + config) + port))))))))) (define (openvpn-shepherd-service role) (lambda (config) @@ -496,7 +523,11 @@ is truncated and rewritten every minute.") config)) (log-file (match role ('server "/var/log/openvpn-server.log") - ('client "/var/log/openvpn-client.log")))) + ('client "/var/log/openvpn-client.log"))) + (script-sec-opts (match role + ('server '()) + ('client (make-script-security-cli-options + config))))) (list (shepherd-service (documentation (string-append "Run the OpenVPN " (match role @@ -510,7 +541,7 @@ is truncated and rewritten every minute.") (start #~(make-forkexec-constructor (list (string-append #$openvpn "/sbin/openvpn") "--writepid" #$pid-file "--config" #$config-file - "--daemon") + #$@script-sec-opts "--daemon") #:pid-file #$pid-file #:log-file #$log-file)) (stop #~(make-kill-destructor))))))) |