nixpkgs/nixos/modules/services/networking/strongswan.nix

171 lines
4.8 KiB
Nix
Raw Normal View History

2014-11-22 18:27:23 +00:00
{ config, lib, pkgs, ... }:
let
inherit (builtins) toFile;
inherit (lib) concatMapStringsSep concatStringsSep mapAttrsToList
mkIf mkEnableOption mkOption types literalExample;
2014-11-22 18:27:23 +00:00
cfg = config.services.strongswan;
ipsecSecrets = secrets: toFile "ipsec.secrets" (
concatMapStringsSep "\n" (f: "include ${f}") secrets
);
ipsecConf = {setup, connections, ca}:
let
# https://wiki.strongswan.org/projects/strongswan/wiki/IpsecConf
makeSections = type: sections: concatStringsSep "\n\n" (
mapAttrsToList (sec: attrs:
"${type} ${sec}\n" +
(concatStringsSep "\n" ( mapAttrsToList (k: v: " ${k}=${v}") attrs ))
) sections
);
setupConf = makeSections "config" { inherit setup; };
connectionsConf = makeSections "conn" connections;
caConf = makeSections "ca" ca;
in
builtins.toFile "ipsec.conf" ''
${setupConf}
${connectionsConf}
${caConf}
'';
strongswanConf = {setup, connections, ca, secretsFile, managePlugins, enabledPlugins}: toFile "strongswan.conf" ''
2014-11-22 18:27:23 +00:00
charon {
${if managePlugins then "load_modular = no" else ""}
${if managePlugins then ("load = " + (concatStringsSep " " enabledPlugins)) else ""}
2014-11-22 18:27:23 +00:00
plugins {
stroke {
secrets_file = ${secretsFile}
2014-11-22 18:27:23 +00:00
}
}
}
starter {
config_file = ${ipsecConf { inherit setup connections ca; }}
}
'';
in
{
options.services.strongswan = {
enable = mkEnableOption "strongSwan";
secrets = mkOption {
type = types.listOf types.str;
2014-11-22 18:27:23 +00:00
default = [];
example = [ "/run/keys/ipsec-foo.secret" ];
description = ''
A list of paths to IPSec secret files. These
2014-11-25 15:01:27 +00:00
files will be included into the main ipsec.secrets file with
the <literal>include</literal> directive. It is safer if these
paths are absolute.
2014-11-22 18:27:23 +00:00
'';
};
setup = mkOption {
type = types.attrsOf types.str;
default = {};
example = { cachecrls = "yes"; strictcrlpolicy = "yes"; };
description = ''
2014-11-25 15:01:27 +00:00
A set of options for the config setup section of the
<filename>ipsec.conf</filename> file. Defines general
configuration parameters.
2014-11-22 18:27:23 +00:00
'';
};
connections = mkOption {
type = types.attrsOf (types.attrsOf types.str);
default = {};
example = literalExample ''
{
"%default" = {
keyexchange = "ikev2";
keyingtries = "1";
};
roadwarrior = {
auto = "add";
leftcert = "/run/keys/moonCert.pem";
leftid = "@moon.strongswan.org";
leftsubnet = "10.1.0.0/16";
right = "%any";
};
}
'';
2014-11-22 18:27:23 +00:00
description = ''
2014-11-25 15:01:27 +00:00
A set of connections and their options for the conn xxx
sections of the <filename>ipsec.conf</filename> file.
2014-11-22 18:27:23 +00:00
'';
};
ca = mkOption {
type = types.attrsOf (types.attrsOf types.str);
default = {};
example = {
strongswan = {
auto = "add";
cacert = "/run/keys/strongswanCert.pem";
crluri = "http://crl2.strongswan.org/strongswan.crl";
};
};
description = ''
2014-11-25 15:01:27 +00:00
A set of CAs (certification authorities) and their options for
the ca xxx sections of the <filename>ipsec.conf</filename>
file.
2014-11-22 18:27:23 +00:00
'';
};
managePlugins = mkOption {
type = types.bool;
default = false;
description = ''
If set to true, this option will disable automatic plugin loading and
then tell strongSwan to enable the plugins specified in the
<option>enabledPlugins</option> option.
'';
};
enabledPlugins = mkOption {
type = types.listOf types.str;
default = [];
description = ''
A list of additional plugins to enable if
<option>managePlugins</option> is true.
'';
};
2014-11-22 18:27:23 +00:00
};
config = with cfg;
let
secretsFile = ipsecSecrets cfg.secrets;
in
mkIf enable
{
# here we should use the default strongswan ipsec.secrets and
# append to it (default one is empty so not a pb for now)
environment.etc."ipsec.secrets".source = secretsFile;
2014-11-22 18:27:23 +00:00
systemd.services.strongswan = {
2014-11-25 15:01:27 +00:00
description = "strongSwan IPSec Service";
2014-11-22 18:27:23 +00:00
wantedBy = [ "multi-user.target" ];
2021-03-14 16:05:16 +00:00
path = with pkgs; [ kmod iproute2 iptables util-linux ]; # XXX Linux
after = [ "network-online.target" ];
2014-11-22 18:27:23 +00:00
environment = {
STRONGSWAN_CONF = strongswanConf { inherit setup connections ca secretsFile managePlugins enabledPlugins; };
2014-11-22 18:27:23 +00:00
};
serviceConfig = {
ExecStart = "${pkgs.strongswan}/sbin/ipsec start --nofork";
};
preStart = ''
# with 'nopeerdns' setting, ppp writes into this folder
mkdir -m 700 -p /etc/ppp
'';
2014-11-22 18:27:23 +00:00
};
};
}