From 4f006e49bfffb49c3009199d5c1e4603cb84c6ba Mon Sep 17 00:00:00 2001 From: Marc Weber Date: Fri, 23 Oct 2009 11:30:54 +0000 Subject: [PATCH] openvpn was broken by jobAttrs. fixed svn path=/nixos/trunk/; revision=17940 --- modules/services/networking/openvpn.nix | 143 +++++++++++++++--------- 1 file changed, 88 insertions(+), 55 deletions(-) diff --git a/modules/services/networking/openvpn.nix b/modules/services/networking/openvpn.nix index b02f18e6b281..78873db67faa 100644 --- a/modules/services/networking/openvpn.nix +++ b/modules/services/networking/openvpn.nix @@ -10,29 +10,29 @@ let PATH = "${pkgs.iptables}/sbin:${pkgs.coreutils}/bin:${pkgs.iproute}/sbin:${pkgs.nettools}/sbin"; - makeOpenVPNJob = cfg : + makeOpenVPNJob = cfg : name: let upScript = '' #!/bin/sh - exec &> /var/log/openvpn-${cfg.id}-up + exec &> /var/log/openvpn-${name}-up PATH=${PATH} ${cfg.up} ''; downScript = '' #!/bin/sh - exec &> /var/log/openvpn-${cfg.id}-down + exec &> /var/log/openvpn-${name}-down PATH=${PATH} ${cfg.down} ''; - configFile = pkgs.writeText "openvpn-config-${cfg.id}" + configFile = pkgs.writeText "openvpn-config-${name}" '' - ${if cfg ? up || cfg ? down then "script-security 2" else ""} + ${if cfg.up != "" || cfg.down != "" then "script-security 2" else ""} ${cfg.config} - ${if cfg ? up then "up ${pkgs.writeScript "openvpn-${cfg.id}-up" upScript}" else "" } - ${if cfg ? down then "down ${pkgs.writeScript "openvpn-${cfg.id}-down" downScript}" else "" } + ${if cfg.up != "" then "up ${pkgs.writeScript "openvpn-${name}-up" upScript}" else "" } + ${if cfg.down != "" then "down ${pkgs.writeScript "openvpn-${name}-down" downScript}" else "" } ''; in { - description = "OpenVPN-${cfg.id}"; + description = "OpenVPN-${name}"; startOn = "network-interfaces/started"; stopOn = "network-interfaces/stop"; @@ -41,12 +41,39 @@ let script = '' - exec &> /var/log/openvpn-${cfg.id} + exec &> /var/log/openvpn-${name} ${config.system.sbin.modprobe} tun || true ${openvpn}/sbin/openvpn --config ${configFile} ''; }; + openvpnInstanceOptions = { + + config = mkOption { + type = types.string; + description = '' + config of this openvpn instance + ''; + }; + up = mkOption { + default = ""; + type = types.string; + description = '' + script which is run when server instance starts up succesfully. + Use it to setup firewall and routing + ''; + }; + down = mkOption { + default = ""; + type = types.string; + description = '' + script which is run when server instance shuts down + Usually this reverts what up has done + ''; + }; + + }; + in { @@ -62,56 +89,64 @@ in description = "Whether to enable OpenVPN."; }; + servers = mkOption { - example = [ - { - id = "server-simplest"; - config = '' - # Most simple configuration: http://openvpn.net/index.php/documentation/miscellaneous/static-key-mini-howto.html. - # server : - dev tun - ifconfig 10.8.0.1 10.8.0.2 - secret static.key - ''; - up = "ip route add ..!"; - down = "ip route add ..!"; - } - { - id = "client-simplest"; - config = '' - #client: - #remote myremote.mydomain - #dev tun - #ifconfig 10.8.0.2 10.8.0.1 - #secret static.key - ''; - } - { - id = "server-scalable"; - config = '' - multiple clienst - see example file found in http://openvpn.net/index.php/documentation/howto.html - ''; - } - { - id = "client-scalabe"; - config = '' dito ''; - } - ]; - default = []; + + default = {}; + + example = { + mostSimple = { + config = '' + # Most simple configuration: http://openvpn.net/index.php/documentation/miscellaneous/static-key-mini-howto.html. + # server : + dev tun + ifconfig 10.8.0.1 10.8.0.2 + secret static.key + ''; + up = "ip route add ..!"; + down = "ip route add ..!"; + }; + clientMostSimple = { + config = '' + #client: + #remote myremote.mydomain + #dev tun + #ifconfig 10.8.0.2 10.8.0.1 + #secret static.key + ''; + }; + serverScalable = { + config = '' + multiple clienst + see example file found in http://openvpn.net/index.php/documentation/howto.html + ''; + }; + }; + # !!! clean up this description please description = '' - openvpn instances to be run. Each will be put into an extra job named openvpn-{id} + You can define multiple openvpn instances. - The up and down properties will be added config line up=/nix/store/xxx-up-script - automatically for you. If you define at least one of up/down - "script-security 2" will be prepended to your config. + The id of an instance is given by the attribute name. - Don't forget to check that the all package sizes can be sent. if scp hangs or such you should set - --fragment XXX --mssfix YYY. + Each instance will result in a new job file. + + Additionally you can specify the up/ down scripts by setting + the up down properties. + Config lines up=/nix/store/xxx-up-script down=... + will be appended to your configuration file automatically + + If you define at least one of up/down "script-security 2" will be + prepended to your config otherwise you scripts aren't run by openvpn + + Don't forget to check that the all package sizes can be sent. For + examlpe if scp hangs you should set --fragment XXX --mssfix YYY. ''; + + type = types.attrsOf types.optionSet; + options = [ openvpnInstanceOptions ]; }; - + }; }; @@ -120,9 +155,7 @@ in ###### implementation config = mkIf cfg.enable { - - jobs = listToAttrs (map (c: nameValuePair "openvpn-${cfg.id}" (makeOpenVPNJob c)) cfg.servers); - + jobs = listToAttrs (mapAttrsFlatten (name: value: nameValuePair "openvpn-${name}" (makeOpenVPNJob value name)) cfg.servers); }; }