unofficial mirror of 
 help / color / Atom feed
From: david larsson <>
To: Damien Cassou <>
Cc: bug-Guix <>,
Subject: bug#39542: Adding openvpn client configurations to guix system
Date: Sat, 01 Aug 2020 14:58:26 +0000
Message-ID: <> (raw)
In-Reply-To: <>

On 2020-08-01 13:44, david larsson wrote:
> On 2020-02-10 15:57, Damien Cassou wrote:
>> Julien Lepiller <> writes:
>>> We already have an openvpn-client-service-type and an
>>> openvpn-server-service-type. It's not linked to network manager
>>> though, I have no idea what it expects there. What do you need
>>> exactly?
>> It seems to me that gnu/services/vpn.scm defines
>> openvpn-server-service-type that triggers the generation of a shepherd
>> service.
>> At the office we use 3 different VPNs that we activate on demand 
>> (test,
>> acceptance and production). If we follow the vpn.scm way, it seems 
>> that
>> this would require 3 shepherd services but I guess it's not possible 
>> to
>> instantiate the openvpn-client-service-type more than once. This seems
>> to be a dead end to me.
> Hi Damien,
> I think I have a solution for you, where you can start 3 different
> vpn's with herd start vpn1-client, herd start vpn2-client etc.
> Below is an ovpn-service.scm module, modeled after vpn.scm. which you
> can include with (use-modules (ovpn-service)) in your config.scm, by
> saving it in the same dir as config.scm. This is tested and works.
> Now, I think you can modify all occurences of the word "ovpn", to, say
> vpn1, vpn2, and vpn3, and save 3 different files, and then use
> (use-modules (vpn1-service) (vpn2-service) (vpn3-service)) etc. in the
> config.scm. An example configuration in the config.scm OS-services
> section would be:
>                   (ovpn-client-service
>                    #:config
>                    (let ([ base-dir
> "/home/myuser/src/my-guixsd-config/etc_openvpn/"]
>                          )
>                      (ovpn-client-configuration
>                       ;; client
>                       (dev 'tun)
>                       ;; remote-random
>                       (proto 'udp)
>                       ;; mute-replay-warnings
>                       ;; replay-window 256
>                       ;; remote-cert-tls server lines is generated 
> somehow
>                       ;; remote-cert-tls server
>                       ;; cipher aes-256-cbc
>                       ;; ncp-ciphers 
> AES-256-GCM:AES-256-CBC:AES-128-GCM
>                       ;; pull
>                       ;; nobind
>                       (bind? #f)
>                       ;; reneg-sec 432000
>                       ;; resolv-retry infinite
>                       (resolv-retry? #t)
>                       ;; compress lzo
>                       (comp-lzo? #t)
>                       ;; verb 3
>                       (verbosity 3)
>                       ;; persist-key
>                       (persist-key? #t)
>                       ;; persist-tun
>                       (persist-tun? #t)
>                       ;; auth-user-pass /etc/openvpn/credentials
>                       (auth-user-pass (string-append base-dir 
> "credentials"))
>                       ;; ca /etc/openvpn/ovpn-ca.crt
>                       (ca (string-append base-dir "ovpn-ca.crt"))
>                       ;; tls-auth /etc/openvpn/ovpn-tls.key 1
>                       (tls-auth (string-append base-dir 
> "ovpn-tls.key"))
>                       ;; log /tmp/openvpn.log
>                       ;; script-security 2
>                       ;; resolv-conf scripts not needed for guix
>                       ;; up /etc/openvpn/update-resolv-conf
>                       ;; down /etc/openvpn/update-resolv-conf
>                       (fast-io? #t)
>                       (remote
>                        (list
>                         ;; Resolves to multiple vpn servers in location
>                  instead       (ovpn-remote-configuration
>                          (name "")
>                          (port 1196))
>                         (ovpn-remote-configuration
>                          (name "")
>                          (port 1197))
>                         (ovpn-remote-configuration
>                          (name "")
>                          (port 1196))
>                         (ovpn-remote-configuration
>                          (name "")
>                          (port 1197))
>                         )))))
> Please let me know if this works for you!
> Best regards,
> David Larsson

and forgot the module, here:

;;; GNU Guix --- Functional package management for GNU
;;; Copyright © 2017 Julien Lepiller <>
;;; Copyright © 2017 Clément Lassieur <>
;;; Copyright © 2017 Mathieu Othacehe <>
;;; This file is part of GNU Guix.
;;; GNU Guix is free software; you can redistribute it and/or modify it
;;; under the terms of the GNU General Public License as published by
;;; the Free Software Foundation; either version 3 of the License, or 
;;; your option) any later version.
;;; GNU Guix is distributed in the hope that it will be useful, but
;;; WITHOUT ANY WARRANTY; without even the implied warranty of
;;; GNU General Public License for more details.
;;; You should have received a copy of the GNU General Public License
;;; along with GNU Guix.  If not, see <>.

(define-module (ovpn-service)
   #:use-module (gnu services)
   #:use-module (gnu services configuration)
   #:use-module (gnu services shepherd)
   #:use-module (gnu system shadow)
   #:use-module (gnu packages admin)
   #:use-module (gnu packages vpn)
   #:use-module (guix packages)
   #:use-module (guix records)
   #:use-module (guix gexp)
   #:use-module (srfi srfi-1)
   #:use-module (ice-9 match)
   #:use-module (ice-9 regex)
   #:export (ovpn-client-service

;;; Ovpn.

(define (uglify-field-name name)
   (match name
     ('verbosity "verb")
     (_ (let ((str (symbol->string name)))
          (if (string-suffix? "?" str)
              (substring str 0 (1- (string-length str)))

(define (serialize-field field-name val)
   (if (eq? field-name 'pid-file)
       (format #t "")
       (format #t "~a ~a\n" (uglify-field-name field-name) val)))
(define serialize-string serialize-field)
(define-maybe string)
(define (serialize-boolean field-name val)
   (if val
       (serialize-field field-name "")
       (format #t "")))

(define (ip-mask? val)
   (and (string? val)
        (if (string-match "^([0-9]+\\.){3}[0-9]+ ([0-9]+\\.){3}[0-9]+$" 
            (let ((numbers (string-tokenize val char-set:digit)))
              (all-lte numbers (list 255 255 255 255 255 255 255 255)))
(define serialize-ip-mask serialize-string)

(define-syntax define-enumerated-field-type
   (lambda (x)
     (define (id-append ctx . parts)
       (datum->syntax ctx (apply symbol-append (map syntax->datum 
     (syntax-case x ()
       ((_ name (option ...))
            (define (#,(id-append #'name #'name #'?) x)
              (memq x '(option ...)))
            (define (#,(id-append #'name #'serialize- #'name) field-name 
              (serialize-field field-name val)))))))

(define-enumerated-field-type proto
   (udp tcp udp6 tcp6))
(define-enumerated-field-type dev
   (tun tap))

(define key-usage? boolean?)
(define (serialize-key-usage field-name value)
   (if value
       (format #t "remote-cert-tls server\n")

(define bind? boolean?)
(define (serialize-bind field-name value)
   (if value
       (format #t "nobind\n")))

(define resolv-retry? boolean?)
(define (serialize-resolv-retry field-name value)
   (if value
       (format #t "resolv-retry infinite\n")

(define (serialize-tls-auth role location)
   (if location
       (serialize-field 'tls-auth
                        (string-append location " " (match role
                                                      ('server "0")
                                                      ('client "1"))))
(define (tls-auth? val)
   (or (eq? val #f)
       (string? val)))
(define (serialize-tls-auth-server field-name val)
   (serialize-tls-auth 'server val))
(define (serialize-tls-auth-client field-name val)
   (serialize-tls-auth 'client val))
(define tls-auth-server? tls-auth?)
(define tls-auth-client? tls-auth?)

(define (serialize-number field-name val)
   (serialize-field field-name (number->string val)))

(define (all-lte left right)
   (if (eq? left '())
       (eq? right '())
       (and (<= (string->number (car left)) (car right))
            (all-lte (cdr left) (cdr right)))))

(define (cidr4? val)
   (if (string? val)
       (if (string-match "^([0-9]+\\.){3}[0-9]+/[0-9]+$" val)
           (let ((numbers (string-tokenize val char-set:digit)))
             (all-lte numbers (list 255 255 255 255 32)))
       (eq? val #f)))

(define (cidr6? val)
   (if (string? val)
       (string-match "^([0-9a-f]{0,4}:){0,8}/[0-9]{1,3}$" val)
       (eq? val #f)))

(define (serialize-cidr4 field-name val)
   (if (eq? val #f) #f (serialize-field field-name val)))

(define (serialize-cidr6 field-name val)
   (if (eq? val #f) #f (serialize-field field-name val)))

(define (ip? val)
   (if (string? val)
       (if (string-match "^([0-9]+\\.){3}[0-9]+$" val)
           (let ((numbers (string-tokenize val char-set:digit)))
             (all-lte numbers (list 255 255 255 255)))
       (eq? val #f)))
(define (serialize-ip field-name val)
   (if (eq? val #f) #f (serialize-field field-name val)))

(define (keepalive? val)
   (and (list? val)
        (and (number? (car val))
             (number? (car (cdr val))))))
(define (serialize-keepalive field-name val)
   (format #t "~a ~a ~a\n" (uglify-field-name field-name)
           (number->string (car val)) (number->string (car (cdr val)))))

(define gateway? boolean?)
(define (serialize-gateway field-name val)
   (and val
        (format #t "push \"redirect-gateway\"\n")))

(define-configuration ovpn-remote-configuration
    (string "my-server")
    "Server name.")
    (number 1194)
    "Port number the server listens to."))

(define-configuration ovpn-ccd-configuration
    (string "client")
    "Client name.")
    (ip-mask #f)
    "Client own network")
    (ip-mask #f)
    "Client VPN IP."))

(define (ovpn-remote-list? val)
   (and (list? val)
        (or (eq? val '())
            (and (ovpn-remote-configuration? (car val))
                 (ovpn-remote-list? (cdr val))))))
(define (serialize-ovpn-remote-list field-name val)
   (for-each (lambda (remote)
               (format #t "remote ~a ~a\n" 
(ovpn-remote-configuration-name remote)
                       (number->string (ovpn-remote-configuration-port 

(define (ovpn-ccd-list? val)
   (and (list? val)
        (or (eq? val '())
            (and (ovpn-ccd-configuration? (car val))
                 (ovpn-ccd-list? (cdr val))))))
(define (serialize-ovpn-ccd-list field-name val)

(define (create-ccd-directory val)
   "Create a ccd directory containing files for the ccd configuration 
of Ovpn.  Each file in this directory represents particular settings for 
client.  Each file is named after the name of the client."
   (let ((files (map (lambda (ccd)
                       (list (ovpn-ccd-configuration-name ccd)
                               (lambda ()
                                  ccd ovpn-ccd-configuration-fields)))))
     (computed-file "ccd"
                    (with-imported-modules '((guix build utils))
                          (use-modules (guix build utils))
                          (use-modules (ice-9 match))
                          (mkdir-p #$output)
                           (lambda (ccd)
                             (match ccd
                               ((name config-string)
                                    (string-append #$output "/" name)
                                  (lambda (port) (display config-string 

(define-syntax define-split-configuration
   (lambda (x)
     (syntax-case x ()
       ((_ name1 name2 (common-option ...) (first-option ...) 
(second-option ...))
            (define-configuration #,#'name1
              common-option ...
              first-option ...)
            (define-configuration #,#'name2
              common-option ...
              second-option ...))))))

(define-split-configuration ovpn-client-configuration
     (package openvpn)
     "The OpenVPN package.")

     (string "/var/run/openvpn/")
     "The OpenVPN pid file.")

     (proto 'udp)
     "The protocol (UDP or TCP) used to open a channel between clients 

     (dev 'tun)
     "The device type used to represent the VPN connection.")

     (maybe-string "/etc/openvpn/ca.crt")
     "The certificate authority to check connections against.")

     ;;(maybe-string "/etc/openvpn/client.crt")
     (maybe-string 'disabled)
     "The certificate of the machine the daemon is running on. It should 
be signed
by the authority given in @code{ca}.")

     ;;(string "/etc/openvpn/client.key")
     (maybe-string 'disabled)
     "The key of the machine the daemon is running on. It must be the key 
certificate is @code{cert}.")

     (boolean #t)
     "Whether to use the lzo compression algorithm.")

     (boolean #t)
     "Don't re-read key files across SIGUSR1 or --ping-restart.")

     (boolean #t)
     "Don't close and reopen TUN/TAP device or run up/down scripts across
SIGUSR1 or --ping-restart restarts.")

      (boolean #f)
      "(Experimental) Optimize TUN/TAP/UDP I/O writes by avoiding a call 
poll/epoll/select prior to the write operation.")

     (number 3)
     "Verbosity level."))
   ;; client-specific configuration
     (tls-auth-client #f)
     "Add an additional layer of HMAC authentication on top of the TLS 
channel to protect against DoS attacks.")

      (maybe-string 'disabled)
      "Authenticate with server using username/password.  The option is a 
containing username/password on 2 lines.  Do not use a file-like object 
as it
would be added to the store and readable by any user.")

     (key-usage #t)
     "Whether to check the server certificate has server usage 

     (bind #f)
     "Bind to a specific local port number.")

     (resolv-retry #t)
     "Retry resolving server address.")

     (boolean #f)
     "Select remotes randomly")
     (boolean #f)
     "Mute replay warnings")
     (number 256)

     (ovpn-remote-list '())
     "A list of remote servers to connect to."))
   ;; server-specific configuration
     (tls-auth-server #f)
     "Add an additional layer of HMAC authentication on top of the TLS 
channel to protect against DoS attacks.")

     (number 1194)
     "Specifies the port number on which the server listens.")

     (ip-mask "")
     "An ip and mask specifying the subnet inside the virtual network.")

     (cidr6 #f)
     "A CIDR notation specifying the IPv6 subnet inside the virtual 

     (string "/etc/openvpn/dh2048.pem")
     "The Diffie-Hellman parameters file.")

     (string "/etc/openvpn/ipp.txt")
     "The file that records client IPs.")

     (gateway #f)
     "When true, the server will act as a gateway for its clients.")

     (boolean #f)
     "When true, clients are allowed to talk to each other inside the 

     (keepalive '(10 120))
     "Causes ping-like messages to be sent back and forth over the link 
so that
each side knows when the other side has gone down. @code{keepalive} 
a pair. The first element is the period of the ping sending, and the 
element is the timeout before considering the other side down.")

     (number 100)
     "The maximum number of clients.")

     (string "/var/run/openvpn/status")
     "The status file. This file shows a small report on current 
connection. It
is truncated and rewritten every minute.")

     (ovpn-ccd-list '())
     "The list of configuration for some clients.")))

(define (ovpn-config-file role config)
   (let ((config-str
            (lambda ()
              (serialize-configuration config
                                       (match role
         (ccd-dir (match role
                    ('server (create-ccd-directory
                    ('client #f))))
     (computed-file "openvpn.conf"
                        (use-modules (ice-9 match))
                        (call-with-output-file #$output
                          (lambda (port)
                            (match '#$role
                              ('server (display "" port))
                              ('client (display "client\n" port)))
                            (display #$config-str port)
                            (match '#$role
                              ('server (display
                                        (string-append "client-config-dir 
                                                       #$ccd-dir "\n") 
                              ('client (display "" port)))))))))

(define (ovpn-shepherd-service role)
   (lambda (config)
     (let* ((config-file (ovpn-config-file role config))
            (pid-file ((match role
                         ('server ovpn-server-configuration-pid-file)
                         ('client ovpn-client-configuration-pid-file))
            (ovpn ((match role
                        ('server ovpn-server-configuration-ovpn)
                        ('client ovpn-client-configuration-ovpn))
            (log-file (match role
                        ('server "/var/log/openvpn-server.log")
                        ('client "/var/log/openvpn-client.log"))))
       (list (shepherd-service
              (documentation (string-append "Run the OpenVPN "
                                            (match role
                                              ('server "server")
                                              ('client "client"))
                                            " daemon."))
              (provision (match role
                           ('server '(ovpn-server))
                           ('client '(ovpn-client))))
              (requirement '(networking))
              (start #~(make-forkexec-constructor
                        (list (string-append #$ovpn "/sbin/openvpn")
                              "--writepid" #$pid-file "--config" 
                        #:pid-file #$pid-file))
              (stop #~(make-kill-destructor)))))))

(define %ovpn-accounts
   (list (user-group (name "openvpn") (system? #t))
          (name "openvpn")
          (group "openvpn")
          (system? #t)
          (comment "Openvpn daemon user")
          (home-directory "/var/empty")
          (shell (file-append shadow "/sbin/nologin")))))

(define %ovpn-activation
       (use-modules (guix build utils))
       (mkdir-p "/var/run/openvpn")))

(define ovpn-server-service-type
   (service-type (name 'ovpn-server)
                  (list (service-extension shepherd-root-service-type
                        (service-extension account-service-type
                                           (const %ovpn-accounts))
                        (service-extension activation-service-type
                                           (const %ovpn-activation))))))

(define ovpn-client-service-type
   (service-type (name 'ovpn-client)
                  (list (service-extension shepherd-root-service-type
                        (service-extension account-service-type
                                           (const %ovpn-accounts))
                        (service-extension activation-service-type
                                           (const %ovpn-activation))))))

(define* (ovpn-client-service #:key (config 
   (validate-configuration config ovpn-client-configuration-fields)
   (service ovpn-client-service-type config))

(define* (ovpn-server-service #:key (config 
   (validate-configuration config ovpn-server-configuration-fields)
   (service ovpn-server-service-type config))

(define (generate-ovpn-server-documentation)
       (ccd ovpn-ccd-configuration))
      (ovpn-ccd-configuration ,ovpn-ccd-configuration-fields))

(define (generate-ovpn-client-documentation)
       (remote ovpn-remote-configuration))
      (ovpn-remote-configuration ,ovpn-remote-configuration-fields))

  reply index

Thread overview: 6+ messages / expand[flat|nested]  mbox.gz  Atom feed  top
2020-02-10  9:33 Damien Cassou
2020-02-10 12:31 ` Julien Lepiller
2020-02-10 15:57   ` Damien Cassou
2020-08-01 13:44     ` david larsson
2020-08-01 14:58       ` david larsson [this message]
2020-08-02 18:33       ` Damien Cassou

Reply instructions:

You may reply publicly to this message via plain-text email
using any one of the following methods:

* Save the following mbox file, import it into your mail client,
  and reply-to-all from there: mbox

  Avoid top-posting and favor interleaved quoting:

  List information:

* Reply using the --to, --cc, and --in-reply-to
  switches of git-send-email(1):

  git send-email \ \ \ \ \ \

* If your mail client supports setting the In-Reply-To header
  via mailto: links, try the mailto: link

unofficial mirror of 

Archives are clonable:
	git clone --mirror guix-bugs/git/0.git

	# If you have public-inbox 1.1+ installed, you may
	# initialize and index your mirror using the following commands:
	public-inbox-init -V2 guix-bugs guix-bugs/ \
	public-inbox-index guix-bugs

Example config snippet for mirrors

Newsgroups are available over NNTP:

AGPL code for this site: git clone