Re: OpenVPN Service

[Julien Lepiller <julien@lepiller.eu>]

Le 17 novembre 2020 21:36:07 GMT-05:00, Raghav Gururajan <rg@raghavgururajan.name> a écrit :
>Hello Guix!
>
>I am struggling to setup OpenVPN Service Type. Here is my current 
>configuration.
>
>*** START ***
>
>(service openvpn-client-service-type
>  (openvpn-client-configuration
>   (remote
>    (list
>     (openvpn-remote-configuration
>      (name "vpn.riseup.net")
>      (port 1194))))
>   (auth-user-pass "/etc/openvpn/Riseup.txt")
>   (ca "/etc/openvpn/RiseupCA.pem")))
>
>*** END ***
>
>When I do, `sudo herd status vpn-client`, I get:
>
>*** START ***
>
>Status of vpn-client:
>   It is stopped.
>   It is enabled.
>   Provides (vpn-client).
>   Requires (networking).
>   Conflicts with ().
>   Will be respawned.
>
>*** END ***
>
>When I do, `openvpn /gnu/store/[...]-openvpn.conf`, I get:
>
>*** START ***
>
>Options error: --ca fails with '/etc/openvpn/ca.crt': No such file or 
>directory (errno=2)

I'm surprised by this one: you already set ca to something different. Can you share the generated openvpn.conf?

>Tue Nov 17 21:32:44 2020 WARNING: cannot stat file 
>'/etc/openvpn/client.key': No such file or directory (errno=2)
>Options error: --key fails with '/etc/openvpn/client.key': No such file

Ok, looking at the service definition, this is not so surprising: it expects a file in the cert and key fields, and uses the defaults here. I'm surprised it doesn't complain about client.crt. I pushed a small update to the service. After you run guix pull, you should be able to specify (cert 'disabled) and (key 'disabled).

>
>or directory (errno=2)
>Tue Nov 17 21:32:44 2020 WARNING: file '/etc/openvpn/Riseup.txt' is 
>group or others accessible
>Options error: Please correct these errors.

This is only a warning, but you don't want your password to be world readable: chown it to openvpn's user, and chmod it to 600.

>
>*** END ***
>
>Could anyone please help me with this?
>
>Regards,
>RG.